CVE-2026-97528 (GCVE-0-2026-97528)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic. Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < a95fc5f1c12bba1dbff72bd2611e7fad0758831b (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < c55d649a6cc246c3ccd5d118faea230c46b60f35 (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a95fc5f1c12bba1dbff72bd2611e7fad0758831b",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "c55d649a6cc246c3ccd5d118faea230c46b60f35",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport-\u003eunsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport-\u003eunsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp-\u003eput_fn, so the out:\npath is the sole free and uctx is always still linked there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Unsolicited FC-NVMe LS frames are posted as PT_LS4_UNSOL; qla24xx_msix_rsp_q() (or qla2xxx_msix_rsp_q \u2192 qla_do_work) runs qla24xx_process_response_queue() \u2192 qla2xxx_process_purls_iocb(), then DPC qla2xxx_process_purls_pkt() \u2192 nvme_fc_rcv_ls_req() and nvme_fc_xmt_ls_rsp() call qla_nvme_xmt_ls_rsp(). FC/FCoE is a non-routable SAN fabric, so Adjacent is the highest defensible vector.\nAC:L - qla_nvme_xmt_ls_rsp() kfree()s uctx on out: when qla2x00_get_sp(GFP_ATOMIC) fails, qla2x00_start_sp() fails after five -EAGAIN retries, or fcport-\u003edeleted is set. A peer floods CREATE_ASSOCIATION LS onto base_qpair or sends LS then LOGO so deleted is set before nvme_fc_handle_ls_rqst_work() calls xmt_ls_rsp; both sides are attacker-driven.\nPR:N - qla2xxx_process_purls_iocb() looks up the sender with qla2x00_find_fcport_by_nportid(incl_deleted=0) and handles PT_LS4_UNSOL in the MSI-X/DPC path with no Linux credential or capability check. FC-SP/EDIF is opt-in; being a logged-in NVMe N_Port is fabric membership, not a privilege on the victim host.\nUI:N - qla24xx_queue_purex_item() sets PROCESS_PUREX_IOCB; qla2xxx_process_purls_pkt() and the nvme_fc rport lsrcv_work then call qla_nvme_xmt_ls_rsp() with no victim mount, open, or administrator action.\nS:U - kfree() of uctx while it remains on fcport-\u003eunsol_ctx_head corrupts that per-fcport list and the host kernel heap inside the qla2xxx driver. Impact stays in the same kernel security authority; it is not a VM escape or IOMMU/DMA bypass.\nC:H - After qla_nvme_xmt_ls_rsp() kfree()s uctx, the next qla2xxx_process_purls_iocb() list_add_tail() and a later list_del() in qla_nvme_release_lsrsp_cmd_kref() or qla2xxx_process_purls_pkt() operate on the freed qla_nvme_unsol_ctx. That use-after-free of a kmalloc object enables disclosure of reused kernel heap.\nI:H - list_add_tail(\u0026uctx-\u003eelem, \u0026fcport-\u003eunsol_ctx_head) writes next/prev through the already-freed node, and list_del() of a neighbor stores those pointers into adjacent heap objects. Combined with attacker-driven uctx allocations of known size, that is a kernel write primitive usable for control-flow hijack.\nA:H - list_add_tail()/list_del() on the dangling uctx-\u003eelem oopses on LIST_POISON or panics on a corrupted next/prev, and the remote peer can repeat PT_LS4_UNSOL to hit the out: path again, taking down the host and its FC-NVMe storage path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:08.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a95fc5f1c12bba1dbff72bd2611e7fad0758831b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c55d649a6cc246c3ccd5d118faea230c46b60f35"
        },
        {
          "url": "https://git.kernel.org/stable/c/e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd"
        }
      ],
      "title": "scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97528",
    "datePublished": "2026-09-25T10:21:30.130Z",
    "dateReserved": "2026-09-24T16:01:01.153Z",
    "dateUpdated": "2026-09-25T14:41:08.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97528",
      "date": "2026-09-28",
      "epss": "0.00318",
      "percentile": "0.22256"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-27T23:45:17.000Z",
      "cve": "CVE-2026-97528",
      "id": "msrc_CVE-2026-97528",
      "initial_release_date": "2026-09-27T23:45:17.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97528.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_nvme.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a95fc5f1c12bba1dbff72bd2611e7fad0758831b",
                    "status": "affected",
                    "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c55d649a6cc246c3ccd5d118faea230c46b60f35",
                    "status": "affected",
                    "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd",
                    "status": "affected",
                    "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_nvme.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport-\u003eunsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport-\u003eunsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp-\u003eput_fn, so the out:\npath is the sole free and uctx is always still linked there."
          }
        ],
        "id": "CVE-2026-97528",
        "lastModified": "2026-09-25T15:17:58.177",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:02.980",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a95fc5f1c12bba1dbff72bd2611e7fad0758831b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c55d649a6cc246c3ccd5d118faea230c46b60f35"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.