UBUNTU-CVE-2026-97537: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque() and qla25xxfreerspque() have two pre-existing bugs exposed on the error path of qla25xxcreate{req,rsp}que(): 1. When dmaalloccoherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dmafreecoherent() with a NULL cpuaddr is undefined behavior and can panic. 2. The free functions clear reqqidmap / rspqidmap under vportlock, but the create functions protect the same bitmaps with mqlock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mqlock before calling the free function, creating a window where another thread can allocate the same queid and have its ha->reqqmap entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dmafreecoherent() with a NULL check on the ring pointer. - Using mqlock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clearbit blocks from the create error paths since the free functions handle it atomically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In qla25xx_free_req_que() and qla25xx_free_rsp_que(), use mq_lock to atomically NULL the req_qid_map/rsp_qid_map entry and clear the bitmap bit; remove the redundant clear_bit operations from the create error paths, and guard dma_free_coherent() with a NULL check on the ring pointer.