UBUNTU-CVE-2026-97536: Use After Free
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxxmsixrspq() schedules qladowork() via queuework(ha->wq, &qpair->qwork). qladowork() dereferences the qpair (vha, rsp) and takes qpair->qplock. During teardown, qla2xxxdeleteqpair() deletes the response queue, which calls freeirq() in qla25xxfreerspque(), and then frees the queue and the qpair. freeirq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending qwork then runs qladowork() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroyworkqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancelworksync() in qla25xxfreerspque() after freeirq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INITWORK() condition and avoid operating on an uninitialized workstruct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In qla25xx_free_rsp_que(), after free_irq() and before freeing the response queue and qpair, call cancel_work_sync() for the qpair work item; guard the cancellation with rsp->qpair and ha->wq to match the INIT_WORK() condition.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the affected Ubuntu kernel packages are exposed when the qla2xxx SCSI driver is in use with queue pairs and response-queue interrupts. The affected package list includes Ubuntu linux, linux-fips, and the AWS, Azure, and GCP kernel variants shown in the advisory.
When can the use-after-free occur?
The issue occurs when a response-queue MSI-X handler has already queued qpair work and queue teardown frees the response queue and qpair before that work executes. It is especially likely during full adapter teardown, because destruction of the workqueue forces pending work to run after the queue pairs have been freed.
Does exploiting this require an authenticated local user?
No privileges or user interaction are required according to the provided vector. Exploitation requires the relevant qla2xxx queue-work and teardown race to occur.
What mitigation is described if an update cannot be applied immediately?
The provided data describes the code-level fix: cancel and flush the queued work with cancel_work_sync() after free_irq() and before freeing the response queue and qpair. No operational workaround is provided.