CVE-2025-39676

What it actually does

The qla4xxx_get_ep_fwdb() function propagates error pointers returned by qla4xxx_ep_connect() instead of converting them to NULL, resulting in an invalid pointer dereference that triggers a kernel oops (crash) in callers.

Why it matters to the business

May cause unexpected system crashes and loss of availability on Linux hosts using QLogic SCSI adapters, interrupting storage operations; low likelihood given minimal EPSS and no known exploitation despite over a year since publication.

How an attack unfolds

An attacker with local access triggers the error path in qla4xxx_ep_connect() so that the resulting error pointer reaches a dereference site inside qla4xxx_get_ep_fwdb(), producing a kernel panic. No named threat actors or campaigns are associated with this issue.

How to fix it

Apply the upstream fix (commit d0225f41ee70611ca88ccb22c8542ecdfa7faea8) or upgrade affected packages to argocd-3.0.13-r1 (MinimOS) or later kernel builds containing the correction.

How to confirm the fix worked

Confirm the presence of commit d0225f41ee70611ca88ccb22c8542ecdfa7faea8 in the running kernel source or verify package versions match the fixed releases; test that qla4xxx_get_ep_fwdb now returns NULL on error paths.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger qla4xxx_ep_connect failure conditions (e.g., via specific adapter or firmware states)
3. Cause qla4xxx_get_ep_fwdb to return the error pointer to its caller
4. Trigger dereference leading to kernel oops

How to detect it

Search kernel logs and crash dumps for oops traces referencing qla4xxx_get_ep_fwdb or qla4xxx_ep_connect; review dmesg output around storage adapter initialization failures.

• qla4xxx_get_ep_fwdb
• qla4xxx_ep_connect
• Oops.*qla4xxx

What your security team should do

• Patch kernels and MinimOS argocd packages to the listed fixed versions at the earliest maintenance window
• Monitor for kernel oops reports involving qla4xxx functions
• Limit local access on systems using qla4xxx hardware until patched