CVE-2026-97537 - Vulnerability Details

- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing
bugs exposed on the error path of qla25xx_create_{req,rsp}_que():

1. When dma_alloc_coherent() fails during queue creation, the error
path calls the free function with req->ring / rsp->ring still NULL
(from kzalloc). The unconditional dma_free_coherent() with a NULL
cpu_addr is undefined behavior and can panic.

2. The free functions clear req_qid_map / rsp_qid_map under vport_lock,
but the create functions protect the same bitmaps with mq_lock.
This provides no mutual exclusion. Additionally, the create error
path clears the bit and releases mq_lock before calling the free
function, creating a window where another thread can allocate the
same que_id and have its ha->req_q_map entry clobbered by the
subsequent lockless NULL assignment in the free function.

Fix by:

- Guarding dma_free_coherent() with a NULL check on the ring pointer.

- Using mq_lock (the lock held by all creators) in the free functions
to atomically NULL the map entry and clear the bitmap bit.

- Removing the now-redundant clear_bit blocks from the create error
paths since the free functions handle it atomically.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qla2xxx SCSI driver in the Linux kernel fails when queue allocation fails: the cleanup path unconditionally frees memory with dma_free_coherent() using a NULL address, causing undefined behavior that can trigger a kernel panic. Additionally, the driver’s bitmap handling lacks proper mutual exclusion, allowing a race that can corrupt the queue‑ID mapping state. Together, these bugs lead to a crash or loss of service for any process that relies on the affected SCSI adapter.

Affected Systems

All Linux distributions that ship a kernel containing the qla2xxx driver and use QLogic QLA2XXX SCSI adapters. The flaw exists in any kernel version prior to the patch commits referenced in the advisory; no specific version range is documented beyond those that include the fixed code.

Risk and Exploitability

The CVE presents a local denial‑of‑service risk that triggers only when the driver’s error path is activated, typically requiring the ability to cause a queue‑allocation failure or to have kernel‑execution privileges. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% points to a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV, meaning no widespread exploitation data is known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`73208dfd7ab19f379d73e8a0fbf30f92c203e5e8`	affected	< 2e6f60adf609c77e828f64e0cd371920bef91c12
`73208dfd7ab19f379d73e8a0fbf30f92c203e5e8`	affected	< 56e25d716833604fd5bff388e472f290bfe793aa
`73208dfd7ab19f379d73e8a0fbf30f92c203e5e8`	affected	< f35cb67f2092b49d7949065dd56895ed47238f22
`73208dfd7ab19f379d73e8a0fbf30f92c203e5e8`	affected	< 94fc0c5b45de2bf3a691619bcfd10b9a49fc647e
`73208dfd7ab19f379d73e8a0fbf30f92c203e5e8`	affected	< 34a40e0dff940ac5eba494a69b553ea571e24873

Linux

affected

Version	Status	Constraints
`2.6.29`	affected	—
`0`	unaffected	< 2.6.29
`6.6.160`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f35cb67f2092b49d7949065dd56895ed47238f22)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,94fc0c5b45de2bf3a691619bcfd10b9a49fc647e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,34a40e0dff940ac5eba494a69b553ea571e24873)`	affected	code_commit	—
`[0,6.18.53)`	affected	generic	—
`[0,7.2.7)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.18.53,6.18.*]`	unaffected	semver	—
`[7.2.7,7.2.*]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates the qla2xxx patch (e.g., the commits referenced in the advisory).
If the QLogic QLA2XXX SCSI adapter is not required, unload or disable the qla2xxx kernel module to remove the threat surface.
Monitor kernel logs (e.g., dmesg or /var/log/kern.log) for oops or panic messages related to qla2xxx and apply any subsequent updates that address new issues.

Generated by OpenCVE AI on October 1, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97537.mbox
https://git.kernel.org/stable/c/2e6f60adf609c77e828f64e0cd371920bef91c12
https://git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873
https://git.kernel.org/stable/c/56e25d716833604fd5bff388e472f290bfe793aa
https://git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e
https://git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22
https://nvd.nist.gov/vuln/detail/CVE-2026-97537
https://www.cve.org/CVERecord?id=CVE-2026-97537

History

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2e6f60adf609c77e828f64e0cd371920bef91c12

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/56e25d716833604fd5bff388e472f290bfe793aa

Thu, 01 Oct 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-754

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97537.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97537 https://www.cve.org/CVERecord?id=CVE-2026-97537
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 26 Sep 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-754

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically.
Title		scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873 https://git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e https://git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:21:35.608Z

Updated: 2026-10-21T12:53:12.722Z

Reserved: 2026-09-24T16:01:01.153Z

Link: CVE-2026-97537

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:03.973

Modified: 2026-10-21T13:21:13.160

Link: CVE-2026-97537

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97537 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T12:00:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object