CVE-2021-46963

What it actually does

Use-after-free caused by an incorrect kmem_cache_free call on an srb structure in qla2xxx_mqueuecommand that is now managed by upper SCSI layers, leading to invalid memory access during request queuing.

Why it matters to the business

Systems using QLogic Fibre Channel adapters may experience kernel crashes or instability during storage I/O operations, with low immediate risk given the age of the issue and minimal observed exploitation.

How an attack unfolds

An attacker with local access triggers SCSI request queuing paths in the qla2xxx driver to reach the erroneous free of the srb, resulting in a subsequent use of the freed memory object and potential crash or memory corruption.

How to fix it

Update to a Linux kernel version containing the fix for the incorrect srb free in qla2xxx_mqueuecommand; apply vendor-supplied kernel updates for affected distributions.

How to confirm the fix worked

Confirm kernel source contains the corrected qla2xxx_mqueuecommand logic without the erroneous kmem_cache_free call; test storage queue operations on QLogic adapters post-update to verify absence of crashes.

Typical attack path

1. Obtain local access to a system with the vulnerable qla2xxx driver loaded
2. Issue storage I/O requests that invoke scsi_queue_rq and qla2xxx_mqueuecommand
3. Trigger the incorrect srb free path during direct request issue
4. Cause subsequent access to the freed srb object

How to detect it

Review kernel logs for call traces referencing kmem_cache_free and qla2xxx_mqueuecommand; inspect for repeated crashes during SCSI request processing on QLogic hardware.

What your security team should do

• Prioritize kernel updates on systems exposing QLogic adapters to untrusted workloads
• Monitor for kernel oops or panic logs involving qla2xxx_mqueuecommand
• Apply updates during routine maintenance given low EPSS and lack of KEV status