CVE-2026-97528 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic.
Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the Linux kernel's qla2xxx SCSI driver represents a critical use-after-free condition arising from improper list management during error handling sequences. Specifically, the function qla_nvme_xmt_ls_rsp() interacts with an unsolicited context structure referred to as uctx. This structure is initially linked into the fcport->unsol_ctx_head list by the qla2xxx_process_purls_iocb() routine and remains attached to this doubly-linked list when the NVMe transport layer invokes a callback to transmit an LS response. The core technical flaw occurs on the error path, designated as out:, where the function proceeds to free the uctx memory using kfree(). However, it fails to remove the node from the fcport->unsol_ctx_head list prior to deallocation. This oversight leaves a dangling pointer within the linked list structure, creating a scenario where the kernel retains references to memory that has already been returned to the allocator pool for potential reuse by other subsystems or processes.
The operational impact of this flaw is severe and can lead to system instability or denial of service conditions. When subsequent operations attempt to manipulate the fcport->unsol_ctx_head list, such as through a list_add_tail() call, the kernel writes data into the memory region previously occupied by uctx but now potentially allocated for unrelated purposes. This constitutes an out-of-bounds write relative to the original object's lifecycle and can corrupt adjacent heap metadata or overwrite critical control structures within other objects sharing that slab cache. Furthermore, if a subsequent list_del() operation is executed on this corrupted node, it may result in double-free conditions, pointer dereferences of invalid addresses, or general kernel panics due to linked list integrity violations. The qla2x00_rel_sp() function's behavior in failure paths further exacerbates the issue by returning SRBs to their pool without invoking necessary cleanup functions like sp->put_fn, ensuring that the out: path remains the primary and often sole location where uctx is freed while still erroneously linked.
From a vulnerability classification perspective, this defect aligns with CWE-416, Use After Free, as it involves accessing memory after it has been released without proper reinitialization or removal from data structures that maintain references to it. Additionally, the mechanism of corrupting kernel lists through invalid writes can be associated with CWE-787, Out-of-bounds Write, particularly when the freed memory is reused and overwritten by legitimate list operations. In terms of adversarial tactics, this type of vulnerability could potentially be leveraged within an ATT&CK framework context under techniques related to Defense Evasion or Privilege Escalation if an attacker can trigger the specific error condition leading to the out: path, although it primarily serves as a stability risk rather than a direct exploitation vector for code execution without additional heap grooming primitives.
To mitigate this vulnerability and restore system integrity, developers must ensure that all list nodes are unlinked from their respective lists before being freed. The corrective action involves inserting a list_del() call on the uctx node immediately prior to invoking kfree() within the error handling path of qla_nvme_xmt_ls_rsp(). This change aligns the code with established patterns found in other parts of the driver, such as qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(), which correctly handle list unlinking before memory deallocation. By ensuring that the fcport->unsol_ctx_head does not retain references to freed memory, the kernel prevents heap corruption and maintains the consistency of internal data structures during high-load or error-prone network operations involving NVMe over Fibre Channel transports.