CVE-2026-97536 (GCVE-0-2026-97536)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 68ca949cdb04b4dc71451a999148fbc5f187a220 , < 1710a69fd74d0b4bdfcc57c3309b1c4057f70d85 (git)
Affected: 68ca949cdb04b4dc71451a999148fbc5f187a220 , < f1f4d1cb93eeeb250eac9405121933e268eefbd3 (git)
Affected: 68ca949cdb04b4dc71451a999148fbc5f187a220 , < 19788a55cab61d78e33e0914a5a31d27843e8a4a (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_mid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1710a69fd74d0b4bdfcc57c3309b1c4057f70d85",
              "status": "affected",
              "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
              "versionType": "git"
            },
            {
              "lessThan": "f1f4d1cb93eeeb250eac9405121933e268eefbd3",
              "status": "affected",
              "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
              "versionType": "git"
            },
            {
              "lessThan": "19788a55cab61d78e33e0914a5a31d27843e8a4a",
              "status": "affected",
              "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_mid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown\n\nThe response queue MSI-X handler qla2xxx_msix_rsp_q() schedules\nqla_do_work() via queue_work(ha-\u003ewq, \u0026qpair-\u003eq_work). qla_do_work()\ndereferences the qpair (vha, rsp) and takes qpair-\u003eqp_lock.\n\nDuring teardown, qla2xxx_delete_qpair() deletes the response queue, which\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and\nthe qpair. free_irq() waits for running hardirq handlers but does not\ncancel work already placed on ha-\u003ewq. A still-pending q_work then runs\nqla_do_work() against the freed qpair and response queue, causing a\nuse-after-free. This is especially likely during full adapter teardown,\nwhere destroy_workqueue(ha-\u003ewq) forces pending work to run after the queue\npairs have been freed.\n\nFlush the work item with cancel_work_sync() in qla25xx_free_rsp_que()\nafter free_irq() has released the interrupt (so no new work can be\nqueued) and before the response queue and qpair memory are freed (so the\nflushed handler still sees valid memory). Guard on rsp-\u003eqpair and ha-\u003ewq\nto match the INIT_WORK() condition and avoid operating on an\nuninitialized work_struct."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - qla2xxx_msix_rsp_q() queue_work()s \u0026qpair-\u003eq_work when firmware posts FC/FCoE response-queue IOCBs (STATUS_TYPE/FCP_RSP, LOGINOUT, CT/ELS); qla25xx_free_rsp_que() is reached from qla2xxx_delete_qpair() via qla25xx_delete_rsp_que(). IS_CNA_CAPABLE QLogic CNAs speak FCoE on the SAN fabric, an L2/adjacent transport not a routable IP service.\nAC:H - The UAF fires only when qla25xx_free_rsp_que() free_irq()s then kfree()s rsp and qla2xxx_delete_qpair() kfree()s the qpair while q_work is still queued. Those run from qla24xx_vport_delete() (fc_vport sysfs S_IWUSR) or qla2x00_free_device() after scsi_remove_host, a victim qpair/adapter teardown a fabric peer cannot initiate.\nPR:N - qla2xxx_msix_rsp_q() handles unauthenticated Fibre Channel/FCoE firmware completions in IRQ context with no capable() or Linux credential check, so a SAN N_Port needs no account on the victim. The teardown path is victim-side and does not grant the fabric attacker host privileges.\nUI:N - qla2xxx_msix_rsp_q() schedules q_work automatically on response-queue interrupts. Concurrent qpair teardown in qla24xx_vport_delete() or qla2x00_remove_one()-\u003eqla2x00_free_device() is driver/NPIV/PCI lifecycle, not a victim mount or open of attacker-supplied media.\nS:U - kfree of struct qla_qpair and struct rsp_que and the later qla_do_work() use-after-free stay inside the host kernel qla2xxx driver and do not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - After kfree(qpair) and kfree(rsp), qla_do_work() container_of()s the freed qpair, loads qpair-\u003evha and qpair-\u003ersp, then qla24xx_process_response_queue() reads the dangling rsp ring/IOCBs. That kernel heap use-after-free enables disclosure of reused object contents.\nI:H - qla_do_work() takes spin_lock_irqsave(\u0026qpair-\u003eqp_lock) on the freed qpair and qla24xx_process_response_queue() writes rsp-\u003ering_index and completion state through dangling rsp/req pointers, yielding a kernel write and control-flow hijack primitive.\nA:H - Use-after-free of qpair from qla_do_work() produces a kernel oops or panic even when not fully exploited. qla2x00_free_device() calls destroy_workqueue(ha-\u003ewq) after qla25xx_delete_queues() has already kfree\u0027d the qpairs, forcing pending q_work to run against freed memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:10.781Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1710a69fd74d0b4bdfcc57c3309b1c4057f70d85"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f4d1cb93eeeb250eac9405121933e268eefbd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/19788a55cab61d78e33e0914a5a31d27843e8a4a"
        }
      ],
      "title": "scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97536",
    "datePublished": "2026-09-25T10:21:34.991Z",
    "dateReserved": "2026-09-24T16:01:01.153Z",
    "dateUpdated": "2026-09-25T14:41:10.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97536",
      "date": "2026-09-28",
      "epss": "0.00267",
      "percentile": "0.16945"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T00:32:58.000Z",
      "cve": "CVE-2026-97536",
      "id": "msrc_CVE-2026-97536",
      "initial_release_date": "2026-09-28T00:32:58.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97536.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_mid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1710a69fd74d0b4bdfcc57c3309b1c4057f70d85",
                    "status": "affected",
                    "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1f4d1cb93eeeb250eac9405121933e268eefbd3",
                    "status": "affected",
                    "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19788a55cab61d78e33e0914a5a31d27843e8a4a",
                    "status": "affected",
                    "version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_mid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.31"
                  },
                  {
                    "lessThan": "2.6.31",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown\n\nThe response queue MSI-X handler qla2xxx_msix_rsp_q() schedules\nqla_do_work() via queue_work(ha-\u003ewq, \u0026qpair-\u003eq_work). qla_do_work()\ndereferences the qpair (vha, rsp) and takes qpair-\u003eqp_lock.\n\nDuring teardown, qla2xxx_delete_qpair() deletes the response queue, which\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and\nthe qpair. free_irq() waits for running hardirq handlers but does not\ncancel work already placed on ha-\u003ewq. A still-pending q_work then runs\nqla_do_work() against the freed qpair and response queue, causing a\nuse-after-free. This is especially likely during full adapter teardown,\nwhere destroy_workqueue(ha-\u003ewq) forces pending work to run after the queue\npairs have been freed.\n\nFlush the work item with cancel_work_sync() in qla25xx_free_rsp_que()\nafter free_irq() has released the interrupt (so no new work can be\nqueued) and before the response queue and qpair memory are freed (so the\nflushed handler still sees valid memory). Guard on rsp-\u003eqpair and ha-\u003ewq\nto match the INIT_WORK() condition and avoid operating on an\nuninitialized work_struct."
          }
        ],
        "id": "CVE-2026-97536",
        "lastModified": "2026-09-25T15:17:58.427",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:03.863",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1710a69fd74d0b4bdfcc57c3309b1c4057f70d85"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19788a55cab61d78e33e0914a5a31d27843e8a4a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1f4d1cb93eeeb250eac9405121933e268eefbd3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.