UBUNTU-CVE-2026-97532: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc() error path When qla2x00memalloc() fails, qla2x00probeone() jumps to probehwfailed and calls qla2x00memfree(). Several error labels in qla2x00memalloc() freed adapter members (elsrej.c, purexdmapool, flt, sfpdata, loopidmap, asyncpd, sfinitcb, exinitcb, npivinfo) but left the pointers dangling. qla2x00memfree() then freed them a second time. Worse, for the dmapool members it issued dmapoolfree(ha->sdmapool, ...) after sdmapool had already been destroyed and set to NULL at failsdmapool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00memfree() skips them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In qla2x00_mem_alloc() error paths, clear each freed adapter member pointer and its associated DMA handle—including elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info—so qla2x00_mem_free() skips them; ensure dma_pool_free() is not called through the already-destroyed NULL s_dma_pool.