CVE-2026-97531 (GCVE-0-2026-97531)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
scsi: qla2xxx: Skip vport under deletion in report ID acquisition
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 41dc529a4602ac737020f423f84686a81de38e6d , < d61e8de98c5a52978fb1edd95fe4dde3131b280e (git)
Affected: 41dc529a4602ac737020f423f84686a81de38e6d , < 7a83979d92782f83c90888ebe19bdc9420521940 (git)
Affected: 41dc529a4602ac737020f423f84686a81de38e6d , < 23582731afa35031c94fadb71a4f3b4afd094649 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_mbx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d61e8de98c5a52978fb1edd95fe4dde3131b280e",
              "status": "affected",
              "version": "41dc529a4602ac737020f423f84686a81de38e6d",
              "versionType": "git"
            },
            {
              "lessThan": "7a83979d92782f83c90888ebe19bdc9420521940",
              "status": "affected",
              "version": "41dc529a4602ac737020f423f84686a81de38e6d",
              "versionType": "git"
            },
            {
              "lessThan": "23582731afa35031c94fadb71a4f3b4afd094649",
              "status": "affected",
              "version": "41dc529a4602ac737020f423f84686a81de38e6d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_mbx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha-\u003evp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha-\u003ed_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The patched format-1 (vp_idx != 0) path in qla24xx_report_id_acquisition() walks ha-\u003evp_list and calls qla_update_host_map() when a VP_RPT_ID_IOCB_TYPE for FDISC complete or VP_STAT_ID_CHG arrives via qla24xx_process_response_queue() from qla24xx_intr_handler/qla24xx_msix_rsp_q, or via qlt_24xx_atio_pkt_all_vps(). A Fibre Channel SAN peer or switch induces those RIDAs; native FC/FCoE is a non-routable L2 fabric, so Adjacent.\nAC:H - The stale host_map insert happens only after qla24xx_vport_delete() sets VPORT_DELETE and qla24xx_disable_vp() RESET_AL_PA zeroes d_id and drops the vport from host_map, but before qla24xx_deallocate_vp_id() unlinks it from vp_list. A fabric attacker cannot write the S_IWUSR sysfs store_fc_vport_delete attribute to start that teardown, so the window is a victim state they cannot induce.\nPR:N - VP_RPT_ID handling in qla24xx_process_response_queue() and qlt_24xx_atio_pkt_all_vps() is an unauthenticated firmware completion of fabric N_Port ID assignment; that interrupt path checks no Linux uid or capability. FC-SP/EDIF is opt-in and is not required to deliver a format-1 RIDA.\nUI:N - Format-1 RIDA is processed automatically in interrupt context when firmware reports a VP ID. Concurrent qla24xx_vport_delete() is an administrator NPIV teardown rather than a mount, open, or other interactive step the attacker solicits.\nS:U - The dangling scsi_qla_host pointer is stored in ha-\u003ehost_map and later consumed in the same host kernel by qla_find_host_by_d_id(); this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After scsi_host_put() at the end of qla24xx_vport_delete() frees the vha, a later btree_lookup32() in qla_find_host_by_d_id() on the re-inserted host_map key returns the freed scsi_qla_host. That use-after-free enables disclosure of reused heap contents.\nI:H - With d_id already zeroed, qla_update_host_map() takes btree_insert32() and plants the dying vha into ha-\u003ehost_map. Later ATIO/ELS dispatch via qla_find_host_by_d_id() writes through that freed scsi_qla_host, giving a kernel write and control-flow primitive.\nA:H - A later host_map lookup of the freed vha from qlt_24xx_atio_pkt_all_vps() (ATIO_TYPE7 d_id) or qla_edif ELS handling oopses in interrupt context, panicking the storage host even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:09.714Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940"
        },
        {
          "url": "https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649"
        }
      ],
      "title": "scsi: qla2xxx: Skip vport under deletion in report ID acquisition",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97531",
    "datePublished": "2026-09-25T10:21:31.968Z",
    "dateReserved": "2026-09-24T16:01:01.153Z",
    "dateUpdated": "2026-09-25T14:41:09.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97531",
      "date": "2026-09-28",
      "epss": "0.00275",
      "percentile": "0.17891"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T02:37:25.000Z",
      "cve": "CVE-2026-97531",
      "id": "msrc_CVE-2026-97531",
      "initial_release_date": "2026-09-28T02:37:25.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Skip vport under deletion in report ID acquisition",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97531.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_mbx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d61e8de98c5a52978fb1edd95fe4dde3131b280e",
                    "status": "affected",
                    "version": "41dc529a4602ac737020f423f84686a81de38e6d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a83979d92782f83c90888ebe19bdc9420521940",
                    "status": "affected",
                    "version": "41dc529a4602ac737020f423f84686a81de38e6d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23582731afa35031c94fadb71a4f3b4afd094649",
                    "status": "affected",
                    "version": "41dc529a4602ac737020f423f84686a81de38e6d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_mbx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha-\u003evp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha-\u003ed_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps()."
          }
        ],
        "id": "CVE-2026-97531",
        "lastModified": "2026-09-25T15:17:58.300",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:03.307",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.