CVE-2026-97536 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock.
During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed.
Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel driver for QLogic Fibre Channel adapters, specifically qla2xxx, contained a critical use-after-free vulnerability within its response queue management logic. This flaw arises from a race condition between hardware interrupt handling and resource teardown procedures during adapter initialization or removal cycles. The core issue involves the asynchronous execution model used by the driver to process SCSI commands and handle responses. When an MSI-X interrupt is triggered for a specific response queue, the handler function qla2xxx_msix_rsp_q() schedules work items via queue_work on a shared worker thread pool associated with the host adapter structure. This scheduled work item eventually invokes qla_do_work(), which dereferences critical data structures including the virtual host adapter and the response queue pair to process pending I/O operations.
The vulnerability manifests during the teardown phase when the driver attempts to delete a specific response queue through the function qla2xxx_delete_qpair(). In this sequence, the code first calls free_irq() to unregister the interrupt handler for that queue, followed by freeing the memory associated with the response queue and its corresponding qpair structure. While free_irq() ensures that any currently executing hardirq handlers complete before returning, it does not cancel work items that have already been queued on the host adapter's worker thread pool but have not yet started execution. Consequently, if a work item was scheduled just prior to or during the interrupt unregistration process, it remains pending in the queue even after the underlying memory structures have been deallocated.
This timing discrepancy leads directly to a use-after-free condition where qla_do_work() attempts to access and lock qpair->qp_lock on memory that has already been freed by free_rsp_que(). The risk is particularly acute during full adapter teardown operations, such as when removing a PCI device or reloading the driver module. In these scenarios, destroy_workqueue is called at the end of the cleanup process, which forces all remaining pending work items to execute before the worker thread pool itself is destroyed. Since the qpair memory was freed earlier in the sequence, this forced execution results in accessing invalid pointers and corrupted data structures, potentially leading to kernel panics, system crashes, or arbitrary code execution if an attacker can influence the state of the freed memory through heap spraying techniques.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, as it involves referencing memory after it has been made available for reuse without proper synchronization to prevent concurrent access during deallocation. In terms of attack vectors and behaviors within the MITRE ATT&CK framework, this flaw relates to Tactic TA0005 Defense Evasion or potentially TA0004 Privilege Escalation depending on exploitability, specifically leveraging improper resource cleanup mechanisms that allow for memory corruption in kernel space. The lack of synchronization between interrupt context teardown and workqueue execution represents a classic concurrency bug where the lifecycle management of asynchronous tasks is not strictly bound to the lifetime of their associated data objects.
To mitigate this vulnerability, the fix implements a strict ordering constraint during the queue freeing process by introducing cancel_work_sync() immediately after free_irq() but before the actual memory deallocation occurs. This function ensures that any pending work items scheduled on the worker thread are flushed and completed before proceeding to release resources. By placing this call after interrupt unregistration, no new work can be queued for execution while the cleanup is in progress, ensuring a clean slate. Simultaneously, performing it before freeing memory guarantees that if there were already pending work items, they will execute against valid, allocated structures rather than freed ones. Additionally, guards are added to check the validity of rsp->qpair and ha->wq to prevent operations on uninitialized work_structs, further hardening the code against edge cases where teardown might be triggered under unusual or partial initialization states. This approach ensures that all asynchronous tasks complete safely before their underlying data structures are destroyed, eliminating the race condition entirely.