CVE-2021-46964 is a vulnerability in the Linux kernel's qla2xxx SCSI driver, which manages QLogic Fibre Channel Host Bus Adapters (HBAs). The issue arises from a recent kernel commit that limited the number of MSI-X interrupt vectors allocated to the number of CPUs. This change inadvertently broke assumptions in the driver's interrupt vector allocation logic, specifically in functions qla83xx_iospace_config(), qla24xx_enable_msix(), and qla2x00_iospace_config(). The driver calculates the maximum number of queue pairs (qpairs) based on the number of MSI-X vectors minus reserved vectors for mailbox interrupts, default response queues, and ATIO (in target modes). In systems with two CPUs operating in initiator mode, this calculation results in zero qpairs. Consequently, the driver does not allocate memory for ha->queue_pair_map, leaving it NULL, but still attempts to access it later in qla2xxx_queuecommand(). This leads to a NULL pointer dereference and kernel crash (BUG), causing a denial of service (DoS) on affected systems. The crash occurs during SCSI command processing, impacting storage I/O operations. The root cause is insufficient allocation of MSI-X vectors to cover all CPUs and reserved interrupts, leading to unbalanced queue pair allocation. The fix involves ensuring enough vectors are allocated to provide each CPU with its own hardware queue while reserving vectors for mailbox, response, and ATIO interrupts. This vulnerability affects Linux kernel versions containing the problematic commit and impacts systems using QLogic HBAs managed by the qla2xxx driver, particularly in virtualized environments with dual-core CPUs. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to servers and storage infrastructure using QLogic Fibre Channel HBAs with affected Linux kernel versions. The kernel crash caused by the NULL pointer dereference results in a denial of service, disrupting critical storage operations. This can lead to downtime for enterprise applications, data unavailability, and potential cascading failures in storage networks. Organizations relying on virtualized environments with dual-core CPUs are particularly susceptible, as the bug manifests under these conditions. The impact is heightened in sectors with high storage demands such as finance, healthcare, telecommunications, and manufacturing, where data availability and integrity are paramount. Additionally, the disruption of storage I/O could affect backup systems, disaster recovery processes, and overall business continuity. Although no remote code execution or privilege escalation is indicated, the DoS effect on storage systems can cause significant operational and financial damage. The lack of known exploits reduces immediate threat levels, but unpatched systems remain vulnerable to accidental or targeted triggering of the crash.

European organizations should take the following specific steps to mitigate this vulnerability: 1) Identify all Linux systems using the qla2xxx driver with affected kernel versions, especially those with QLogic Fibre Channel HBAs. 2) Apply the official Linux kernel patches that fix the MSI-X vector allocation logic as soon as they become available from trusted sources or Linux distributions. 3) For virtualized environments, consider increasing CPU cores temporarily or adjusting VM configurations to avoid the dual-core initiator mode scenario until patches are applied. 4) Monitor kernel logs for signs of qla2xxx driver crashes or NULL pointer dereferences to detect potential exploitation or accidental triggering. 5) Implement rigorous change management and testing procedures for kernel updates to minimize downtime. 6) Maintain up-to-date backups and disaster recovery plans to mitigate the impact of potential DoS events. 7) Engage with hardware vendors to confirm compatibility and firmware updates for QLogic HBAs that may complement kernel fixes. 8) Limit access to systems with affected drivers to trusted personnel to reduce risk of intentional triggering. These measures go beyond generic advice by focusing on the specific driver, hardware, and environment conditions that trigger the vulnerability.