CVE-2026-97536
Received Received - Intake

Use-After-Free in Linux Kernel qla2xxx Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97536
EUVD
EUVD-2026-86844

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's qla2xxx SCSI driver. It occurs when the response queue MSI-X handler schedules work on a queue pair that gets freed during teardown. The work item runs after the memory is freed, causing a use-after-free condition, especially during full adapter teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx SCSI driver and involves a use-after-free condition during queue teardown. Detection requires checking the kernel version and qla2xxx driver status. Use 'uname -a' to check the kernel version and 'lsmod | grep qla2xxx' to verify if the driver is loaded. If the kernel version is vulnerable and the driver is active, further investigation of system logs for qla2xxx-related errors may be needed.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. It primarily affects systems using the qla2xxx driver for SCSI devices, potentially causing instability during device teardown or heavy workloads.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the qla2xxx driver if not in use by blacklisting it via 'echo blacklist qla2xxx >> /etc/modprobe.d/blacklist.conf' followed by 'update-initramfs -u'. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart