Login Sign Up

CVE-2025-71232

N/A Unknown
Denial of Service

📋 TL;DR

A memory leak vulnerability in the Linux kernel's QLogic Fibre Channel driver (qla2xxx) can cause system crashes during driver unload operations. This affects systems using QLogic Fibre Channel HBAs with the qla2xxx driver loaded. The vulnerability occurs when the driver fails to properly free memory in error paths during module removal.

💻 Affected Systems

Products:
  • Linux kernel with qla2xxx driver
Versions: Kernel versions containing the vulnerable qla2xxx driver code (specific versions not specified in CVE, but patches exist for multiple stable branches)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects systems with QLogic Fibre Channel Host Bus Adapters (HBAs) using the qla2xxx driver. The vulnerability triggers during driver unload (rmmod) operations.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash and kernel panic during driver unload, potentially causing data corruption or service disruption on systems using QLogic Fibre Channel storage.

🟠

Likely Case

System instability or crash during driver load/unload operations, particularly in environments with frequent driver updates or module testing.

🟢

If Mitigated

No impact if the driver is not being unloaded or if the system is not using QLogic Fibre Channel adapters.

🌐 Internet-Facing: LOW - This is a local kernel driver issue requiring local access to unload modules.
🏢 Internal Only: MEDIUM - Could affect production systems during maintenance operations or driver updates, potentially causing service disruption.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: NO
Unauthenticated Exploit: ✅ No
Complexity: LOW - Requires root/privileged access to unload kernel modules.

This is a reliability issue rather than a security vulnerability that enables privilege escalation or remote code execution. Exploitation requires local privileged access to trigger the crash condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes: 05fcd590e5fbbb3e9e1b4fc6c23c98a1d38cf256, 19ac050ef09a2f0a9d9787540f77bb45cf9033e8, aed16d37696f494288a291b4b477484ed0be774b, f04840512438ac025dea6e357d80a986b28bbe4c

Vendor Advisory: https://git.kernel.org/stable/c/05fcd590e5fbbb3e9e1b4fc6c23c98a1d38cf256

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. For custom kernels, apply the relevant patch from kernel.org. 3. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Avoid driver unload operations

linux

Prevent triggering the vulnerability by avoiding qla2xxx driver unload operations.

# Do not run: rmmod qla2xxx
# Avoid automated driver reload scripts that might trigger the issue

🧯 If You Can't Patch

  • Avoid unloading the qla2xxx driver module unless absolutely necessary
  • Schedule driver maintenance during planned downtime windows to minimize impact of potential crashes

🔍 How to Verify

Check if Vulnerable:

Check if qla2xxx driver is loaded and kernel version is unpatched: lsmod | grep qla2xxx && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to a version containing the fix and test driver unload: rmmod qla2xxx (if safe to do in test environment)

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic or crash during qla2xxx driver unload
  • Warnings about 'Objects remaining in qla2xxx_srbs' in kernel logs
  • System crashes during rmmod qla2xxx operations

Network Indicators:

  • None - this is a local kernel issue

SIEM Query:

source="kernel" AND ("qla2xxx_srbs" OR "kmem_cache_destroy qla2xxx_srbs" OR "Objects remaining in qla2xxx_srbs")

📊 Metadata

CVE ID: CVE-2025-71232
CVSS v3 Score: N/A (Unknown)
Published: February 18, 2026
Last Updated: February 23, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON