CVE-2025-71235: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71235 is a race condition vulnerability in the Linux kernel's qla2xxx SCSI driver that causes a kernel crash (system panic) when a module unload is initiated while a fabric scan (device discovery) is in progress. It affects Linux kernel versions from 4.8 through multiple stable branches, with fixed versions including 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, and 6.19.1. The vulnerability was published on February 18, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a race condition (CWE-362) in the qla2xxx driver's module unload path. When the driver sets an UNLOADING flag during module teardown, it prevents new work items from being allocated during an ongoing fabric scan. This causes DMA memory to be freed in interrupt context — an unsafe operation — leading to a kernel panic. The crash trace shows the fault originating in qla24xx_sp_unmap() called from the IRQ handler path (qla24xx_msix_rsp_q → qla24xx_process_response_queue → qla24xx_els_ct_entry → qla_async_scan_sp_done), indicating the interrupt fires after the driver has already begun teardown (Red Hat CVE, Feedly).

Successful triggering of this vulnerability results in a kernel panic, causing complete system unavailability (denial of service). There is no confidentiality or integrity impact — the vulnerability is limited to availability. Environments most at risk are those that perform frequent qla2xxx driver reloads, hot-plug operations on QLogic Fibre Channel adapters, or automated load/unload testing cycles (Red Hat CVE).

Apply the patched kernel versions released across all affected stable branches: 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, and 6.19.1. Patches are available via the upstream kernel stable tree, as well as from Red Hat, Microsoft (Azure Linux), Debian (DSA-6163-1, DLA-4499-1), SUSE, Oracle Linux, and Amazon Linux 2. As a temporary workaround, avoid initiating qla2xxx module unload operations while fabric scanning or device discovery is active. Systems in environments with frequent driver reloads or Fibre Channel hot-plug operations should be prioritized for patching (Red Hat CVE, Microsoft MSRC, Debian LTS).