Security readout for executives and security teams
Plain-English summary
This issue can crash a Linux system when the qla2xxx storage driver is unloaded while a fabric scan is still running. The business impact is availability risk on systems using that driver, especially storage-connected hosts. The source bundle does not provide CVSS, confirmed exploitation, or broad product impact beyond Linux kernel affected versions.
Executive priority
Treat as a targeted availability issue for Linux storage infrastructure. Patch during normal kernel maintenance, escalating priority for hosts where an unexpected crash would disrupt production storage or critical workloads.
Technical view
During qla2xxx discovery, an interrupt can schedule work while module unload has set the UNLOADING flag. Because the work item is not allocated, mapped memory is freed in interrupt context, causing a crash. The kernel fix delays driver unload until the fabric scan completes.
Likely exposure
Likely limited to Linux systems running affected kernel versions where the qla2xxx SCSI driver is present and used. Systems not loading this driver or not using the relevant fabric scan path are unlikely to be exposed based on the supplied evidence.
Exploitation context
The source bundle says KEV is false and provides no evidence of active exploitation. The described trigger came from load/unload testing in a loop during fabric discovery, not from a reported in-the-wild attack.
Researcher notes
The evidence supports a kernel-driver crash caused by unsafe free behavior in interrupt context during module unload. Impact scope, exploitability, and CVSS are not provided. Validation should focus on driver presence, affected kernel lineage, and whether downstream distributions have shipped equivalent fixes.
Mitigation direction
- Apply vendor-provided kernel updates containing the referenced stable fixes.
- Prioritize storage hosts that load or depend on the qla2xxx driver.
- Avoid unnecessary qla2xxx module unloads during active fabric discovery until patched.
- Check Linux distribution advisories for backported fixed kernel packages.
Validation and detection
- Inventory Linux hosts for affected kernel versions and qla2xxx driver usage.
- Confirm whether qla2xxx is loaded on storage-connected systems.
- Verify installed kernels include the referenced upstream stable commits or vendor backports.
- Review crash logs for qla2xxx call traces during module unload or fabric scans.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit d8af012f92eee021c6ebb7093e65813c926c336b
- Linux stable commit 891f9969a29e9767a453cef4811c8d2472ccab49
- Linux stable commit 984dc1a51bf6fc3ca4e726abe790ec38952935d8
- Linux stable commit 528b2f1027edfb52af0171f0f4b227fb356dde05
- Linux stable commit d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
- Linux stable commit c068ebbaf52820d6bdefb9b405a1e426663c635a
- Linux stable commit 7062eb0c488f35730334daad9495d9265c574853
- Linux stable commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71235 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336bCVE reference, Linux
- https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49CVE reference, Linux
- https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8CVE reference, Linux
- https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05CVE reference, Linux
- https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32CVE reference, Linux
- https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635aCVE reference, Linux
- https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853CVE reference, Linux
- https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.