UBUNTU-CVE-2026-97531: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition() format-1 handling walks ha->vplist under vportslock, takes a vrefcount on the matching vport and calls qlaupdatehostmap() to register its port id. A vport teardown via qla24xxvportdelete() sets VPORTDELETE, then qla24xxdisablevp() removes the vport from the hostmap btree and zeroes vha->did (RESETALPA). The vport is only unlinked from vplist later, in qla24xxdeallocatevpid(), which clears vpmap[idx] (RESETVPIDX) but does not touch hostmap. In the window in between, report ID acquisition can still find the vport on vplist and call qlaupdatehostmap(); with did already zeroed it takes the btreeinsert32() path and re-inserts the dying vport into hostmap. Nothing cleans that entry afterwards, so once scsihostput() frees the vha a later hostmap lookup dereferences freed memory. Skip a vport that has VPORTDELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00alertallvps().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In qla24xx_report_id_acquisition() format-1 handling, skip any vport with VPORT_DELETE set before taking its vref_count, preventing qla_update_host_map() from re-registering the vport or scheduling DPC re-registration.