All vulnerabilities
CVE-2026-97528

Linux: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in925a9129a514b7c3bc0a8af01e51868adbb9a83eFixed versionCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 925a9129a514b7c3bc0a8af01e51868adbb9a83eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error

qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic.

Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.

Text from CVE List

Affected versions 12

  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before 925a9129a514b7c3bc0a8af01e51868adbb9a83eCVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before cbbf1484496aac86038e67ac984949af58009d4bCVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before a95fc5f1c12bba1dbff72bd2611e7fad0758831bCVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before c55d649a6cc246c3ccd5d118faea230c46b60f35CVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before e46160a5d4fa59bf4d5f3412b6b5cb79edb967ddCVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5