In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. When qla2x00_async_iocb_timeout(…
High CVSS 8.8
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. When qla2x00_async_iocb_timeout() starts to run it can be preempted by the normal response path (via the firmware?). qla24xx_async_gpsc_sp_done() releases the SRB unconditionally. When scheduling back to qla2x00_async_iocb_timeout() qla24xx_async_abort_cmd() will access an freed sp->qpair pointer: qla2xxx [0000:83:00.0]-2871:0:…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/31e6cdbe0eae37badceb5e0d4f06cf051432fd77 Patch
- https://git.kernel.org/stable/c/ceda7f794f3dfe272491e93e3e93049f8be5f07b Patch
- https://git.kernel.org/stable/c/e140723f78ff418c8df7d990e102e07b65c87d4a Patch
- https://git.kernel.org/stable/c/e17111dd2fda81c35f309b1e5b6ab35809a375e7 Patch
Timeline
- nvd_ingest NVD