Martin K. Petersen

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** A use-after-free issue has been resolved in the Linux kernel, specifically in the scsi: qla2xxx module. This issue occurs when the `dpc thread` is terminated using the `UNLOADING` flag and `kthread stop` simultaneously, causing a system crash with a stack trace warning of use-after-free. The `UNLOADING` flag is removed to terminate `dpc thread`, and `kthread stop` is used as the main signal to exit `dpc thread`. The issue is observed on HP ProLiant DL380p Gen8 systems with BIOS P70 08/20/2012. **Recommendations** To resolve this issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider disabling the `qla2xxx` module until a patch is available. Restrict access to the `dpc thread` to minimize the risk of exploitation. Avoid using the `UNLOADING` flag to terminate `dpc thread` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.14.0-39.el9.x86 64 **Description** The vulnerability is related to the `bnx2fc` driver in the Linux kernel. The `bnx2fc destroy()` function removes the interface before calling `destroy work`, resulting in multiple warnings from `sysfs remove group()` as the controller rport device attributes are removed too early. This issue can be reproduced by following specific steps, including enabling `fcoe` and executing `fipvlan` and `fcoeadm` commands. The problem is caused by the removal of the `fcoe port`'s `destroy work` queue, which is not needed. **Recommendations** To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, for Linux kernel version 5.14.0-39.el9.x86 64, ensure that the `bnx2fc` driver is updated to flush the `destroy work` queue before calling `bnx2fc interface put()`. As a temporary workaround, consider disabling the `fcoe` interface until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL pointer dereference in the `qedf update link speed()` function when `shost data` is not initialized. This occurs when the `qedf link update()` API is called from QED. The problem results in a NULL pointer dereference when trying to update `supported speeds`. To fix this, a NULL pointer check should be added before dereferencing `shost data`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.1.5 **Description** An issue was discovered in the MPT3COMMAND case in ctl ioctl main in drivers/scsi/mpt3sas/mpt3sas ctl.c. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of `ioc number` between two kernel reads of that value, aka a "double fetch" vulnerability. A third party reports that this is unexploitable because the doubly fetched value is not used. **Recommendations** For Linux kernel versions through 5.1.5, consider upgrading to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.