Security readout for executives and security teams
Plain-English summary
CVE-2025-71238 is a Linux kernel bug in the qla2xxx SCSI driver. Some error paths can call cleanup twice, causing a double free and observed kernel panic. Business risk is mainly service disruption on affected Linux systems using this driver, especially storage-connected servers.
Executive priority
Treat as a focused availability risk for Linux storage infrastructure, not a broad internet-facing emergency based on current evidence. Patch affected systems through normal kernel update channels, prioritizing critical servers where an unexpected kernel panic would cause business interruption.
Technical view
The vulnerable qla_bsg.c logic calls bsg_done() in failure cases where most routines only call it on success. That can double free BSG request state and trigger a kernel crash during qla2xxx vendor-specific processing. Stable kernel commits add validation before calling bsg_done().
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the qla2xxx driver and BSG vendor-specific paths. The provided trace shows a crash during qlafwupdate.sub on an HPE ProLiant system, but the CVE record does not define hardware scope beyond Linux.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation. The documented failure mode is a kernel panic from double-free behavior, not a described remote compromise. Public exploit status is not established by the provided sources.
Researcher notes
Evidence supports a double-free in qla2xxx BSG completion handling with stable commits available. Missing data includes CVSS, CWE, precise distribution package ranges, and exploitability analysis. Do not assume remote reachability or privilege impact beyond the documented kernel panic without additional vendor analysis.
Mitigation direction
- Identify Linux systems using the qla2xxx driver.
- Prioritize storage hosts where kernel panic would disrupt operations.
- Apply vendor or distribution kernel updates containing the referenced stable fixes.
- Check Linux distribution advisories for supported package names and backport status.
- Avoid unsourced workarounds; follow kernel or distribution guidance.
Validation and detection
- Confirm current kernel version and distribution patch level.
- Check whether qla2xxx is loaded or present on target systems.
- Review kernel logs for qla2xxx, bsg_done, or qlafwupdate crash traces.
- Map installed kernels against vendor advisories and referenced stable commits.
- Regression test storage connectivity after kernel updates.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 057a5bdc481e58ab853117254867ffb22caf9f6e
- Linux stable commit f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720
- Linux stable commit 27ac9679c43a09e54e2d9aae9980ada045b428e0
- Linux stable commit 74e7458537cd9349cf019862e51491f670871707
- Linux stable commit 871f6236da96c4a9712b8a29d7f555f767a47e95
- Linux stable commit 31f33b856d2324d86bcaef295f4d210477a1c018
- Linux stable commit 708003e1bc857dd014d4c44278d7d77c26f91b1c
- Linux stable commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/057a5bdc481e58ab853117254867ffb22caf9f6eCVE reference, Linux
- https://git.kernel.org/stable/c/f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720CVE reference, Linux
- https://git.kernel.org/stable/c/27ac9679c43a09e54e2d9aae9980ada045b428e0CVE reference, Linux
- https://git.kernel.org/stable/c/74e7458537cd9349cf019862e51491f670871707CVE reference, Linux
- https://git.kernel.org/stable/c/871f6236da96c4a9712b8a29d7f555f767a47e95CVE reference, Linux
- https://git.kernel.org/stable/c/31f33b856d2324d86bcaef295f4d210477a1c018CVE reference, Linux
- https://git.kernel.org/stable/c/708003e1bc857dd014d4c44278d7d77c26f91b1cCVE reference, Linux
- https://git.kernel.org/stable/c/c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.