CVE-2025-71232: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71232 is a memory leak vulnerability in the Linux kernel's qla2xxx SCSI driver (used with QLogic/Cavium Fibre Channel adapters) that causes a system crash during driver load/unload cycles. The flaw arises because service request pointers (sp) are not freed in error paths, leaving objects in the qla2xxx_srbs slab cache when the module is unloaded. Affected Linux kernel versions span from 4.16 through multiple stable branches, with fixed versions including 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, and 6.19.1. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime): the qla2xxx driver fails to call sp_free() (or equivalent) in certain error code paths during driver initialization or teardown, causing allocated SCSI request block (srb) objects to persist in the kernel slab allocator. When the module is subsequently unloaded via rmmod, kmem_cache_destroy() detects remaining objects in the qla2xxx_srbs cache and triggers a kernel BUG, resulting in a system crash. Exploitation requires local access with low privileges (e.g., the ability to load/unload the kernel module), and the crash is most reliably triggered by repeatedly loading and unloading the qla2xxx driver in a loop (Red Hat CVE, Feedly).

Successful triggering of this vulnerability results in a kernel BUG and system crash (availability impact: High), as evidenced by the BUG qla2xxx_srbs: Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() message in kernel logs. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Systems performing frequent driver reload operations (e.g., during maintenance windows or automated testing on servers with QLogic/Cavium HBAs) are most at risk of forced restarts (Red Hat CVE, Feedly).

• Logs: Kernel log messages containing BUG qla2xxx_srbs or Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown(); stack traces referencing kmem_cache_destroy, qla2x00_module_exit, or __kmem_cache_shutdown in /var/log/kern.log or dmesg output.
• Process: Repeated execution of rmmod qla2xxx or modprobe -r qla2xxx followed by system instability or unexpected reboots.
• System: Unexpected system crashes or kernel panics on hosts equipped with QLogic/Cavium Fibre Channel HBAs, particularly during driver maintenance operations.

Update the Linux kernel to a patched version for the applicable stable branch: 5.10.251+, 5.15.201+, 6.1.164+, 6.6.125+, 6.12.72+, 6.18.11+, or 6.19.1+. Patches are available via upstream kernel stable commits (e.g., 05fcd590e5, 19ac050ef0, 7adbd2b780, 8e7597b4ef, aed16d376, b410ab8b94, b74408de1f, f048405124) and through vendor channels including Red Hat, Debian (DSA-6163-1, DLA-4499-1), SUSE, Oracle Linux, and Amazon Linux 2. As a short-term workaround, minimize or avoid repeated qla2xxx driver load/unload cycles until patching is complete, and schedule any required driver reloads during maintenance windows (Red Hat CVE, Microsoft MSRC, Feedly).