CVE-2025-71232: Linux Kernel Privilege Escalation Flaw

CVE-2025-71232 Overview

CVE-2025-71232 is a memory leak vulnerability in the Linux kernel's qla2xxx SCSI driver that can cause system crashes during module load/unload operations. The vulnerability occurs when the sp (SCSI request packet) is not properly freed in error paths, leading to objects remaining in the qla2xxx_srbs slab cache. This results in a kernel BUG when attempting to destroy the kmem cache during module unload, causing system instability and potential denial of service.

Critical Impact
System crash during driver module unload due to improper memory management in the qla2xxx SCSI driver error handling path, affecting enterprise server availability.

Affected Products

Linux kernel with qla2xxx SCSI driver module
HPE ProLiant DL385 Gen10 Plus v2 and similar QLogic HBA systems
Enterprise Linux distributions using kernel 5.14.0 and related versions

Discovery Timeline

2026-02-18 - CVE CVE-2025-71232 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-71232

Vulnerability Analysis

This vulnerability is a memory leak issue that manifests during the error handling path of the qla2xxx SCSI driver. When the driver encounters an error condition, it fails to properly free the allocated SCSI request packet (sp) structure. This causes objects to remain in the qla2xxx_srbs slab cache, which becomes problematic during module unload operations.

When the qla2x00_module_exit function attempts to destroy the kmem cache via kmem_cache_destroy(), the kernel detects that objects still exist in the cache, triggering a kernel BUG condition. The crash trace shows the failure occurring at __kmem_cache_shutdown() with the message "Objects remaining in qla2xxx_srbs".

The vulnerability affects systems performing repeated driver load/unload operations, such as during testing, hot-plug scenarios, or driver updates on enterprise servers using QLogic Fibre Channel host bus adapters.

Root Cause

The root cause is a missing memory deallocation in the error path of the qla2xxx driver. When certain error conditions occur during SCSI command processing, the allocated sp structure is not freed before the function returns. This creates a memory leak where slab objects accumulate in the qla2xxx_srbs cache.

The fix involves adding proper sp deallocation calls in the error handling paths to ensure all allocated SCSI request packets are freed regardless of whether the operation succeeds or fails. This follows the standard kernel memory management pattern of ensuring symmetric allocation and deallocation.

Attack Vector

The attack vector for this vulnerability is local, requiring the ability to trigger driver module unload operations on the affected system. While not directly exploitable for privilege escalation, the vulnerability can be triggered by:

Performing repeated module load/unload cycles (e.g., via modprobe and rmmod commands)
Hot-plug operations involving QLogic HBA hardware
Driver update procedures that require module reloading
Automated testing frameworks that exercise driver initialization paths

The resulting system crash leads to denial of service, making this particularly impactful in enterprise environments where the qla2xxx driver is commonly used for storage connectivity.

Detection Methods for CVE-2025-71232

Indicators of Compromise

Kernel log messages containing BUG qla2xxx_srbs with taint indicators
Warning messages: kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects
Stack traces showing __kmem_cache_shutdown failures during qla2x00_module_exit
System crashes or kernel panics during qla2xxx module unload operations

Detection Strategies

Monitor kernel logs for slab cache errors related to qla2xxx_srbs during driver operations
Implement alerting on kernel taint flags (Tainted: G B OE) associated with qla2xxx module activity
Track module load/unload events and correlate with subsequent system instability
Use kernel tracing tools to monitor kmem_cache_destroy calls for the qla2xxx driver

Monitoring Recommendations

Configure syslog monitoring to capture kernel BUG and WARNING messages related to memory management
Implement automated health checks for systems using QLogic HBAs, particularly after maintenance windows
Monitor system uptime and correlate unexpected reboots with driver operations
Use crash dump analysis to identify qla2xxx-related memory leak conditions

How to Mitigate CVE-2025-71232

Immediate Actions Required

Apply the kernel patches from the stable kernel tree that address the memory leak in error paths
Avoid unnecessary module unload operations on production systems until patches are applied
Schedule maintenance windows for kernel updates on systems using qla2xxx drivers
Implement monitoring for the specific kernel warning messages associated with this vulnerability

Patch Information

Multiple kernel patches have been released to address this vulnerability by properly freeing the sp structure in error paths. The patches are available through the following kernel commits:

Apply the appropriate patch based on your kernel version and distribution.

Workarounds

Minimize module unload operations on production systems until patched kernels are deployed
If testing requires module cycling, ensure adequate system monitoring and crash recovery procedures are in place
Consider using live patching solutions if available for your distribution to apply fixes without rebooting
Plan kernel updates during scheduled maintenance windows to minimize service disruption

bash

# Check current kernel version and qla2xxx module status
uname -r
modinfo qla2xxx | grep -E "version|filename"

# Monitor for the specific warning messages
dmesg | grep -E "qla2xxx_srbs|kmem_cache_destroy"

# Update kernel using package manager (example for RHEL/CentOS)
yum update kernel
reboot