CVE-2026-97531
Received Received - Intake

Use-After-Free in Linux Kernel QLA2xxx Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97531
EUVD
EUVD-2026-86839

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SCSI qla2xxx driver. It occurs when a vport (virtual port) is being deleted but another process tries to acquire its report ID. The vport's deletion process leaves it temporarily in a state where it can still be accessed, leading to a memory corruption when the host structure is freed while the vport is still referenced.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx SCSI driver and involves race conditions during vport teardown. Detection requires kernel-level inspection of the qla2xxx driver and its vport handling. Check kernel logs for qla2xxx errors or warnings using dmesg | grep qla2xxx. Monitor for crashes or memory corruption after vport operations. No direct network commands detect this; focus on system logs and kernel state.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or privilege escalation if exploited. Systems using SCSI qla2xxx devices, particularly those with virtual ports, are at risk. Attackers with local access might trigger this issue to destabilize the system or gain unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this qla2xxx vulnerability. If patching is not immediately possible, avoid creating or deleting vports dynamically. Monitor system stability and check for kernel crashes. Consider disabling vport functionality if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart