Quinn Tran

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** A use-after-free issue has been resolved in the Linux kernel, specifically in the scsi: qla2xxx module. This issue occurs when the `dpc thread` is terminated using the `UNLOADING` flag and `kthread stop` simultaneously, causing a system crash with a stack trace warning of use-after-free. The `UNLOADING` flag is removed to terminate `dpc thread`, and `kthread stop` is used as the main signal to exit `dpc thread`. The issue is observed on HP ProLiant DL380p Gen8 systems with BIOS P70 08/20/2012. **Recommendations** To resolve this issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider disabling the `qla2xxx` module until a patch is available. Restrict access to the `dpc thread` to minimize the risk of exploitation. Avoid using the `UNLOADING` flag to terminate `dpc thread` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been resolved. The issue occurs in the scsi: qla2xxx driver, where a call to the midlayer function `fc remote port delete` can put the thread to sleep while in interrupt context, triggering a crash. The problem arises from scheduling while atomic. To address this, the call is scheduled in non-interrupt context for safety. **Recommendations** As a temporary workaround, consider disabling the interrupt context for the `fc remote port delete` function call until a patch is available. Restrict access to the `qla2xxx` driver to minimize the risk of exploitation. Avoid using the `qla2x00 schedule rport del` function in the affected kernel until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.