UBUNTU-CVE-2026-89848: Use After Free
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair() deletes the request queue before the response queue. qla25xxdeletereqque() frees the request queue memory (kfree(req) in qla25xxfreereqque()), but the response-queue MSI-X is only released later, in qla25xxfreerspque(). In that window the response interrupt can still fire, qla2xxxmsixrspq() queues qpair->qwork, and qladowork() -> qla24xxprocessresponsequeue() dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path), a use-after-free. The cancelworksync() added for the qpair teardown lives in the response free path, which runs after the request queue is already freed, so it does not protect rsp->req. Release the response-queue interrupt and flush qpair->qwork before deleting the request queue, so no late completion can reach the freed request queue. Clearing haveirq makes the subsequent qla25xxfreerspque() skip its freeirq(), and the firmware queue-delete order (request then response) is preserved; the request-delete mailbox completes on the default vector and is unaffected by dropping the qpair response interrupt early.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
During qla2xxx qpair teardown, release or quiesce the response-queue MSI-X interrupt and flush qpair->q_work before deleting or freeing the request queue, so late response completions cannot dereference the freed rsp->req.