CVE-2026-97532
Received Received - Intake

Double Free in Linux Kernel QLA2xxx Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97532
EUVD
EUVD-2026-86840

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver. When memory allocation fails in qla2x00_mem_alloc(), error handling code frees certain adapter members but leaves their pointers dangling. Later, qla2x00_mem_free() attempts to free these already-freed pointers, causing a double-free condition. For DMA pool members, it also dereferences a NULL pool pointer after it was destroyed.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx SCSI driver and involves double-free errors in memory handling. Detection requires checking kernel logs for SCSI driver errors or crashes related to qla2xxx. Monitor system logs for messages like 'NULL pointer dereference' or 'double free' in the SCSI subsystem. No direct commands are provided in the context, but examining kernel logs with 'dmesg' or 'journalctl -k' may reveal issues.

Impact Analysis

This could lead to kernel crashes, system instability, or potential privilege escalation if exploited. Systems using affected qla2xxx driver versions may experience unexpected behavior or denial of service when memory allocation fails during driver initialization.

Mitigation Strategies

Apply the latest kernel updates or patches that address this specific issue in the qla2xxx driver. If a patch is unavailable, consider disabling the qla2xxx driver if not required. Monitor vendor advisories for kernel updates and test patches in a non-production environment before deployment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart