CVE-2026-97532: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Null out freed pointers in qla2x00memalloc() error path
When qla2x00memalloc() fails, qla2x00probeone() jumps to probehwfailed and calls qla2x00memfree(). Several error labels in qla2x00memalloc() freed adapter members (elsrej.c, purexdmapool, flt, sfpdata, loopidmap, asyncpd, sfinitcb, exinitcb, npivinfo) but left the pointers dangling. qla2x00memfree() then freed them a second time. Worse, for the dmapool members it issued dmapoolfree(ha->sdmapool, ...) after sdmapool had already been destroyed and set to NULL at failsdmapool, dereferencing a NULL pool.
Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00memfree() skips them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In qla2x00_mem_alloc() error paths, clear/null each freed adapter pointer and its associated DMA handle—including elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info—so the subsequent qla2x00_mem_free() skips them and does not free them again.
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered when qla2x00_mem_alloc() fails during qla2xxx adapter probing. The subsequent cleanup path calls qla2x00_mem_free() after some adapter resources have already been freed.
What is the impact of the faulty cleanup path?
The cleanup can double-free resources whose pointers were left dangling. For DMA-pool resources, it can call dma_pool_free() using a pool that was already destroyed and set to NULL, causing a NULL-pool dereference.
Which resources are involved in the double-free risk?
The affected error paths include elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info. The fix clears freed pointers and associated DMA handles so later cleanup skips them.