CVE-2026-97537: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking
qla25xxfreereqque() and qla25xxfreerspque() have two pre-existing bugs exposed on the error path of qla25xxcreate{req,rsp}que():
1. When dmaalloccoherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dmafreecoherent() with a NULL cpuaddr is undefined behavior and can panic.
2. The free functions clear reqqidmap / rspqidmap under vportlock, but the create functions protect the same bitmaps with mqlock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mqlock before calling the free function, creating a window where another thread can allocate the same queid and have its ha->reqqmap entry clobbered by the subsequent lockless NULL assignment in the free function.
Fix by:
- Guarding dmafreecoherent() with a NULL check on the ring pointer.
- Using mqlock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit.
- Removing the now-redundant clearbit blocks from the create error paths since the free functions handle it atomically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update qla25xx_free_req_que() and qla25xx_free_rsp_que() to guard dma_free_coherent() when req->ring or rsp->ring is NULL, use mq_lock to atomically NULL the req_qid_map/rsp_qid_map entry and clear its bitmap bit, and remove the redundant clear_bit blocks from the qla25xx_create_{req,rsp}_que() error paths.
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
The NULL dma_free_coherent() case is exposed when dma_alloc_coherent() fails while creating a request or response queue. The bitmap and queue-map race requires queue creation and teardown activity that can overlap across threads.
What is the practical impact of the affected error path?
Freeing a queue whose ring allocation failed can invoke dma_free_coherent() with a NULL CPU address, which is undefined behavior and can panic the system. The locking issue can also allow a newly allocated queue ID's map entry to be cleared by another queue's cleanup.