CVE-2026-97531: scsi: qla2xxx: Skip vport under deletion in report ID acquisition

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Skip vport under deletion in report ID acquisition

qla24xxreportidacquisition() format-1 handling walks ha->vplist under vportslock, takes a vrefcount on the matching vport and calls qlaupdatehostmap() to register its port id.

A vport teardown via qla24xxvportdelete() sets VPORTDELETE, then qla24xxdisablevp() removes the vport from the hostmap btree and zeroes vha->did (RESETALPA). The vport is only unlinked from vplist later, in qla24xxdeallocatevpid(), which clears vpmap[idx] (RESETVPIDX) but does not touch hostmap. In the window in between, report ID acquisition can still find the vport on vplist and call qlaupdatehostmap(); with did already zeroed it takes the btreeinsert32() path and re-inserts the dying vport into hostmap. Nothing cleans that entry afterwards, so once scsihostput() frees the vha a later hostmap lookup dereferences freed memory.

Skip a vport that has VPORTDELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00alertallvps().

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
DescriptionSeverity
Data Sourced
via NVD·11:17 AM
DescriptionSeverity

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel qla2xxx SCSI driver with virtual ports are exposed when a virtual port is being deleted while report ID acquisition processes the virtual-port list. The affected race involves the driver's host_map tracking for those virtual ports.

2

What conditions are needed to trigger the use-after-free?

A virtual-port teardown must overlap with qla24xx_report_id_acquisition() format-1 handling. The acquisition path can find the still-linked, deletion-marked virtual port after its port ID has been zeroed and reinsert it into host_map; a later lookup can then dereference it after the virtual host has been freed.

3

How can I tell whether the vulnerable state has occurred?

The described persistent bad state is a dying virtual port being reinserted into the qla2xxx host_map after VPORT_DELETE is set and its d_id is zeroed. The provided information does not specify a user-visible log message, diagnostic command, or reliable runtime indicator for detecting that state.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203