EUVD-2026-80463
GHSA-43g8-fhx4-jf78
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Firmware-triggered NULL deref in the driver's IRQ path is local and timing-dependent (AV:L/AC:H), needs host access/FC configuration (PR:L), and only crashes the kernel (A:H, C/I:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context.
Return early when cmd is NULL, before touching cmd->sc_data_direction.
AnalysisAI
Kernel crash (NULL pointer dereference) in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver, in the EDIF (encrypted FC / FC security) RX security-association delete check, allowing a host using that driver and feature to be taken down by a kernel oops in interrupt context. Only systems with a QLogic FC adapter, the qla2xxx driver loaded, and EDIF/FC-SP encryption in use are exposed; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (integrity and confidentiality unaffected, availability high), which is considerably narrower than the vendor's published AV:N/AC:L/PR:N rating and reflects that triggering the fault depends on a driver-internal abort/return timing race rather than remotely supplied network input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a system running the Linux qla2xxx driver with a QLogic Fibre Channel HBA and the EDIF (encrypted FC / FC security) feature in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a NULL pointer dereference (CWE-476) in the qla2xxx FC HBA driver's EDIF (encrypted FC) status-completion path, resulting in a kernel crash in interrupt context - a pure availability/DoS bug (vendor vector C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the upstream stable fixes and move to at least 5.15.221 (5.15 branch), 6.1.188 (6.1 branch), 6.6.157 (6.6 branch), 6.12.110 (6.12 branch), 6.18.51 (6.18 branch), or 7.2.5 (7.2 branch); mainline is fixed as of 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems with QLogic Fibre Channel HBAs to determine which are running the qla2xxx driver and have EDIF/FC-SP encryption enabled, as only these are exposed; prioritize any that are business-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today