CVE-2025-71232: Linux Kernel Privilege Escalation Flaw

CVE-2025-71232 Overview

CVE-2025-71232 is a memory leak vulnerability in the Linux kernel's qla2xxx SCSI driver that can cause system crashes during module load/unload operations. The vulnerability occurs when the sp (SCSI request packet) is not properly freed in error paths, leading to objects remaining in the qla2xxx_srbs slab cache. This results in a kernel BUG when attempting to destroy the kmem cache during module unload, causing system instability and potential denial of service.

Critical Impact

System crash during driver module unload due to improper memory management in the qla2xxx SCSI driver error handling path, affecting enterprise server availability.

Affected Products

• Linux kernel with qla2xxx SCSI driver module
• HPE ProLiant DL385 Gen10 Plus v2 and similar QLogic HBA systems
• Enterprise Linux distributions using kernel 5.14.0 and related versions

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-71232 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-71232

Vulnerability Analysis

This vulnerability is a memory leak issue that manifests during the error handling path of the qla2xxx SCSI driver. When the driver encounters an error condition, it fails to properly free the allocated SCSI request packet (sp) structure. This causes objects to remain in the qla2xxx_srbs slab cache, which becomes problematic during module unload operations.

When the qla2x00_module_exit function attempts to destroy the kmem cache via kmem_cache_destroy(), the kernel detects that objects still exist in the cache, triggering a kernel BUG condition. The crash trace shows the failure occurring at __kmem_cache_shutdown() with the message "Objects remaining in qla2xxx_srbs".

The vulnerability affects systems performing repeated driver load/unload operations, such as during testing, hot-plug scenarios, or driver updates on enterprise servers using QLogic Fibre Channel host bus adapters.

Root Cause

The root cause is a missing memory deallocation in the error path of the qla2xxx driver. When certain error conditions occur during SCSI command processing, the allocated sp structure is not freed before the function returns. This creates a memory leak where slab objects accumulate in the qla2xxx_srbs cache.

The fix involves adding proper sp deallocation calls in the error handling paths to ensure all allocated SCSI request packets are freed regardless of whether the operation succeeds or fails. This follows the standard kernel memory management pattern of ensuring symmetric allocation and deallocation.

Attack Vector

The attack vector for this vulnerability is local, requiring the ability to trigger driver module unload operations on the affected system. While not directly exploitable for privilege escalation, the vulnerability can be triggered by:

• Performing repeated module load/unload cycles (e.g., via modprobe and rmmod commands)
• Hot-plug operations involving QLogic HBA hardware
• Driver update procedures that require module reloading
• Automated testing frameworks that exercise driver initialization paths

The resulting system crash leads to denial of service, making this particularly impactful in enterprise environments where the qla2xxx driver is commonly used for storage connectivity.

Detection Methods for CVE-2025-71232

Indicators of Compromise

• Kernel log messages containing BUG qla2xxx_srbs with taint indicators
• Warning messages: kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects
• Stack traces showing __kmem_cache_shutdown failures during qla2x00_module_exit
• System crashes or kernel panics during qla2xxx module unload operations

Detection Strategies

• Monitor kernel logs for slab cache errors related to qla2xxx_srbs during driver operations
• Implement alerting on kernel taint flags (Tainted: G B OE) associated with qla2xxx module activity
• Track module load/unload events and correlate with subsequent system instability
• Use kernel tracing tools to monitor kmem_cache_destroy calls for the qla2xxx driver

Monitoring Recommendations

• Configure syslog monitoring to capture kernel BUG and WARNING messages related to memory management
• Implement automated health checks for systems using QLogic HBAs, particularly after maintenance windows
• Monitor system uptime and correlate unexpected reboots with driver operations
• Use crash dump analysis to identify qla2xxx-related memory leak conditions

How to Mitigate CVE-2025-71232

Immediate Actions Required

• Apply the kernel patches from the stable kernel tree that address the memory leak in error paths
• Avoid unnecessary module unload operations on production systems until patches are applied
• Schedule maintenance windows for kernel updates on systems using qla2xxx drivers
• Implement monitoring for the specific kernel warning messages associated with this vulnerability

Patch Information

Multiple kernel patches have been released to address this vulnerability by properly freeing the sp structure in error paths. The patches are available through the following kernel commits:

• Kernel Commit 05fcd590
• Kernel Commit 19ac050e
• Kernel Commit 8e7597b4
• Kernel Commit aed16d37
• Kernel Commit b410ab8b
• Kernel Commit b74408de
• Kernel Commit f0484051

Apply the appropriate patch based on your kernel version and distribution.

Workarounds

• Minimize module unload operations on production systems until patched kernels are deployed
• If testing requires module cycling, ensure adequate system monitoring and crash recovery procedures are in place
• Consider using live patching solutions if available for your distribution to apply fixes without rebooting
• Plan kernel updates during scheduled maintenance windows to minimize service disruption

# Check current kernel version and qla2xxx module status
uname -r
modinfo qla2xxx | grep -E "version|filename"

# Monitor for the specific warning messages
dmesg | grep -E "qla2xxx_srbs|kmem_cache_destroy"

# Update kernel using package manager (example for RHEL/CentOS)
yum update kernel
reboot