CVE-2026-97532: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Null out freed pointers in qla2x00memalloc() error path
When qla2x00memalloc() fails, qla2x00probeone() jumps to probehwfailed and calls qla2x00memfree(). Several error labels in qla2x00memalloc() freed adapter members (elsrej.c, purexdmapool, flt, sfpdata, loopidmap, asyncpd, sfinitcb, exinitcb, npivinfo) but left the pointers dangling. qla2x00memfree() then freed them a second time. Worse, for the dmapool members it issued dmapoolfree(ha->sdmapool, ...) after sdmapool had already been destroyed and set to NULL at failsdmapool, dereferencing a NULL pool.
Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00memfree() skips them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the qla2x00_mem_alloc() error path, clear each freed adapter pointer and its DMA handle, including elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info; set the corresponding dma_pool members to NULL before qla2x00_mem_free() runs so subsequent cleanup skips already-freed objects.
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered when qla2x00_mem_alloc() fails during qla2xxx adapter probing. The subsequent cleanup path calls qla2x00_mem_free() after some adapter resources have already been freed.
What is the impact of the faulty cleanup path?
The cleanup can double-free resources whose pointers were left dangling. For DMA-pool resources, it can call dma_pool_free() using a pool that was already destroyed and set to NULL, causing a NULL-pool dereference.
Which resources are involved in the double-free risk?
The affected error paths include elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info. The fix clears freed pointers and associated DMA handles so later cleanup skips them.