CVE-2025-71238: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71238 is a double free vulnerability in the Linux kernel's qla2xxx SCSI driver, specifically in the bsg_done() function. The flaw occurs when certain routines in qla_bsg.c invoke bsg_done() for both success and failure cases during vendor-specific BSG (Block SCSI Generic) request processing, leading to a double free condition and kernel panic. Affected Linux kernel versions span multiple stable branches: 5.7–5.10 (before 5.10.251), 5.11–5.15 (before 5.15.201), 5.16–6.1 (before 6.1.164), 6.2–6.6 (before 6.6.127), 6.7–6.12 (before 6.12.74), 6.13–6.18 (before 6.18.13), and 6.19+ (before 6.19.3). The vulnerability was published on March 4, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, Feedly).

The root cause is classified as CWE-415 (Double Free): certain code paths in qla_bsg.c call bsg_done() unconditionally for both the success and error handling branches of vendor-specific BSG request processing in the QLA2xxx Fibre Channel adapter driver, resulting in the same memory being freed twice. This triggers a kernel page fault (observed at memcpy_erms+0x6/0x10) when the freed memory is subsequently accessed, causing a kernel panic. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user with access to the BSG interface on a system with a QLA2xxx adapter. A real-world kernel panic was observed on an HPE ProLiant DL360 Gen11 running RHEL 9.5 kernel 5.14.0-503.34.1.el9_5.x86_64 during firmware update operations via qlafwupdate.sub (Feedly, kernel.org patches).

Successful exploitation can cause kernel panics and system crashes (denial of service), and may allow a local low-privileged attacker to corrupt kernel memory with potential for arbitrary code execution at kernel privilege level. The vulnerability affects confidentiality, integrity, and availability — all rated High — meaning an attacker could read, write, or execute arbitrary kernel memory within the scope of the compromised process. Systems with QLA2xxx Fibre Channel HBAs (common in enterprise SAN environments) are at risk, and exploitation could disrupt storage connectivity and data access across affected hosts (Feedly).

1. Identify target: Locate a Linux system with a QLA2xxx Fibre Channel adapter and a vulnerable kernel version (e.g., RHEL/CentOS/Debian/SUSE with kernel before the patched versions). Confirm the qla2xxx kernel module is loaded via lsmod | grep qla2xxx.
2. Gain local access: Obtain a local shell with low-privilege user access on the target system (e.g., via SSH with a standard user account).
3. Access BSG interface: Identify the BSG device node associated with the QLA2xxx adapter, typically at /dev/bsg/ (e.g., /dev/bsg/fc_host0). Access may require membership in the disk group or similar.
4. Send vendor-specific BSG request: Craft and submit a vendor-specific BSG IOCTL request to the QLA2xxx driver (e.g., using tools like sg_raw or a custom program using ioctl(fd, SG_IO, ...)) that triggers the code path in qla_bsg.c where bsg_done() is called for both success and failure branches.
5. Trigger double free: The double invocation of bsg_done() frees the same memory region twice, corrupting kernel heap structures and triggering a page fault or kernel panic, resulting in denial of service or potential kernel memory corruption for privilege escalation.

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg referencing BUG: unable to handle page fault for address with RIP: 0010:memcpy_erms and stack traces involving qla2xxx or qla_bsg functions.
• Logs: System crash dumps (kdump) generated on systems with QLA2xxx adapters, particularly following BSG-related operations such as firmware updates.
• Process: Unusual processes interacting with /dev/bsg/ device nodes, especially non-root processes or unexpected tools like qlafwupdate.sub running outside of maintenance windows.
• File System: Presence of core dump files or kdump captures in /var/crash/ following unexpected system reboots on hosts with Fibre Channel HBAs.
• Network: Unexpected loss of SAN/Fibre Channel connectivity from affected hosts, potentially indicating a kernel panic has occurred.

Apply kernel updates to the following patched versions based on your branch: 5.10.251+ (for 5.7–5.10), 5.15.201+ (for 5.11–5.15), 6.1.164+ (for 5.16–6.1), 6.6.127+ (for 6.2–6.6), 6.12.74+ (for 6.7–6.12), 6.18.13+ (for 6.13–6.18), and 6.19.3+ (for 6.19+). Vendor-specific updates are available from Red Hat (RHSA-2026:6053, RHSA-2026:6571, RHSA-2026:6954, and others), Debian (DSA-6163-1, DLA-4498-1), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1), AlmaLinux (ALSA-2026-6571), Rocky Linux, Oracle Linux, and Amazon Linux 2 (Feedly, Red Hat). As a temporary workaround where patching is not immediately possible, restrict local user access to BSG device nodes (/dev/bsg/) and disable BSG support for QLA2xxx adapters if not operationally required. Monitor kernel logs for page fault exceptions related to qla2xxx or memcpy operations.

The vulnerability was covered as part of Microsoft's March 2026 Patch Tuesday coverage, which addressed 79 flaws including two zero-days, with CVE-2025-71238 noted among the Linux kernel issues patched in Microsoft's CBL-Mariner and Azure Linux distributions (BleepingComputer). Multiple Linux distribution vendors (Red Hat, Debian, SUSE, Oracle, AlmaLinux, Rocky Linux) issued advisories and updates promptly following disclosure. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard vulnerability tracking feeds.