CVE-2026-97532 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.
Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the Linux kernel's SCSI QLogic 2xxx driver involves a critical resource management flaw located in the memory allocation and deallocation routines of the qla2xx module. Specifically, the function qla2x00_mem_alloc is responsible for allocating various hardware-specific data structures and DMA pools required for adapter operation. During the initialization phase, if this allocation process encounters an error at any stage, control flow transfers to a failure label within the same function. The intended behavior in such scenarios is to clean up all previously allocated resources before returning an error code to prevent memory leaks or inconsistent driver states. However, the implementation contains a logical defect where pointers to these freed resources are not nullified after being released.
This oversight leads directly to double-free vulnerabilities and potential NULL pointer dereferences during the subsequent cleanup phase. When qla2x00_mem_alloc fails, it frees specific adapter members such as elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, and npiv_info. Although these memory blocks are returned to the kernel allocator, the corresponding pointers in the host adapter structure remain pointing to their previous addresses. Later, when qla2x00_probe_one detects the failure of allocation, it invokes qla2x00_mem_free to perform a comprehensive cleanup. Because the pointers were not cleared during the initial error handling path within qla2x00_mem_alloc, qla2x00_mem_free attempts to free these same memory regions again. This results in double-free conditions for standard kernel memory allocations, which can corrupt internal allocator data structures and potentially lead to arbitrary code execution or system crashes depending on how quickly the freed memory is reallocated by other subsystems.
The situation is exacerbated regarding DMA pool members where a NULL pointer dereference occurs alongside the double-free risk. In specific error paths such as fail_s_dma_pool, the s_dma_pool member is explicitly set to NULL after being destroyed via dma_pool_free. However, subsequent labels in the same function may still attempt to access or free this pool without checking if it has already been nullified and freed by earlier failure handlers. This leads to calls like dma_pool_free(ha->s_dma_pool) where ha->s_dma_pool is effectively NULL or points to invalid memory due to prior deallocation. Such operations violate kernel safety constraints, causing immediate kernel panics on affected systems that utilize QLogic Fibre Channel adapters during initialization failures.
From a classification perspective, this vulnerability aligns with CWE-415 Double Free and CWE-824 Access of Uninitialized Pointer in contexts where the pointer value is stale after deallocation. It also relates to CWE-762 Mismatched Memory Management Routines due to inconsistent handling of allocation and cleanup paths. In terms of attack vectors, while this primarily affects system stability rather than direct remote exploitation, it falls under ATT&CK technique T1499 Endpoint Denial of Service if an attacker can trigger the initialization failure repeatedly or in conjunction with other vulnerabilities that force memory pressure conditions. The impact is severe as it compromises kernel integrity and availability, potentially allowing local users to crash the system or escalate privileges through heap corruption mechanisms inherent in double-free exploits.
Mitigation for this issue requires ensuring that all pointers are explicitly set to NULL immediately after their associated resources are freed within every error label of qla2x00_mem_alloc. This practice ensures that subsequent calls to qla2x00_mem_free can safely check for non-NULL values before attempting deallocation, thereby preventing double-free operations and invalid memory accesses. For system administrators unable to apply immediate kernel patches, disabling the specific QLogic adapter or avoiding configurations that might trigger early initialization failures during boot processes may serve as a temporary workaround until updated driver packages are deployed by distribution maintainers.