CVE-2025-71238 in Linux
Summary
by MITRE • 03/04/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix bsg_done() causing double free
Kernel panic observed on system,
[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000
[5353358.825194] #PF: supervisor write access in kernel mode
[5353358.825195] #PF: error_code(0x0002) - not-present page
[5353358.825196] PGD 100006067 P4D 0
[5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI
[5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1
[5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025
[5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10
[5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246
[5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000
[5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000
[5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000
[5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090
[5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000
[5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000
[5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0
[5353358.825221] PKRU: 55555554
[5353358.825222] Call Trace:
[5353358.825223] <TASK>
[5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df
[5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df
[5353358.825232] ? sg_copy_buffer+0xc8/0x110
[5353358.825236] ? __die_body.cold+0x8/0xd
[5353358.825238] ? page_fault_oops+0x134/0x170
[5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110
[5353358.825244] ? exc_page_fault+0xa8/0x150
[5353358.825247] ? asm_exc_page_fault+0x22/0x30
[5353358.825252] ? memcpy_erms+0x6/0x10
[5353358.825253] sg_copy_buffer+0xc8/0x110
[5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]
[5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]
Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/24/2026
The vulnerability identified as CVE-2025-71238 affects the Linux kernel's qla2xxx SCSI driver, specifically within the SCSI generic (SG) subsystem implementation. This issue manifests as a double free condition in the bsg_done() function, which occurs when the function is invoked both for successful operations and failure scenarios, leading to a kernel panic and system crash. The flaw is particularly concerning as it directly impacts storage subsystem reliability and system stability, especially in enterprise environments where high availability is critical.
The technical root cause of this vulnerability lies in improper resource management within the qla2xxx driver's BSG (Block Storage Generic) implementation. The kernel panic occurs when attempting to access an invalid memory address, specifically ff5f5e897b024000, which triggers a page fault during a memcpy operation. This memory access violation stems from a double free scenario where the bsg_done() function is called twice on the same buffer, causing memory corruption and subsequent kernel oops. The call trace demonstrates the execution path leading to the failure, showing that the issue originates from qla24xx_bsg_request() calling functions that eventually result in improper bsg_done() invocation.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a critical memory corruption vulnerability that can be exploited to cause denial of service or potentially enable privilege escalation in certain scenarios. The vulnerability affects systems running kernel versions 5.14.0-503.34.1.el9_5.x86_64 and potentially other versions within the same kernel release series. According to CWE standards, this vulnerability maps to CWE-415: Double Free, which is a well-known class of memory corruption vulnerabilities that can lead to arbitrary code execution or system instability. The ATT&CK framework categorizes this under privilege escalation and denial of service techniques, as an attacker could potentially leverage such a condition to compromise system integrity.
Mitigation strategies for this vulnerability require immediate kernel updates to patched versions that properly validate bsg_done() calls before execution. System administrators should prioritize patching affected systems, particularly those running enterprise storage solutions using QLogic qla2xxx drivers. The fix involves implementing proper validation logic to ensure bsg_done() is only called once per operation, preventing the double free condition. Additional monitoring should be implemented to detect potential exploitation attempts, and system hardening measures such as kernel lockdown and secure boot should be enabled to reduce the attack surface. Organizations should also consider implementing automated patch management processes to ensure timely deployment of security updates across their infrastructure.
This vulnerability highlights the importance of proper resource management in kernel space drivers and demonstrates how seemingly simple programming errors can result in critical system stability issues. The issue emphasizes the need for comprehensive testing of driver code, particularly in high-stakes enterprise environments where storage subsystem reliability is paramount. The fix implemented in the patched kernel versions ensures proper resource lifecycle management, preventing the double free condition that led to the kernel panic and system crashes observed in affected systems.