Skip to content

Check your stack

CVE-2026-97537

scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

Products / packages Linux

Published 25/09/2026, 10:21:35 UTC

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 20:55:32 UTC

Severity

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

8 ranges

Linux version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before b65e3a82f77b7a63e386623d2ea70d2b5580295a

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before a9ff85886425355c72749be6090758aa19a89f16

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before 81ee4df2a488f0909f7ff563e88a0e0099485a8b

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before 2e6f60adf609c77e828f64e0cd371920bef91c12

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before 56e25d716833604fd5bff388e472f290bfe793aa

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before f35cb67f2092b49d7949065dd56895ed47238f22

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before 94fc0c5b45de2bf3a691619bcfd10b9a49fc647e

git versions

73208dfd7ab19f379d73e8a0fbf30f92c203e5e8 → before 34a40e0dff940ac5eba494a69b553ea571e24873

git versions

Other versions: unaffected

Linux · Linux

Linux

10 ranges

Linux version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

2.6.29

unaffected

0 → before 2.6.29

semver versions

5.10.273 → through 5.10.*

semver versions

5.15.224 → through 5.15.*

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.112 → through 6.12.*

semver versions

6.18.53 → through 6.18.*

semver versions

7.2.7 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que():

When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic.
The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function.

Fix by:

Guarding dma_free_coherent() with a NULL check on the ring pointer.
Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit.
Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically.

References

8 sources

git.kernel.org/stable/c/b65e3a82f77b7a63e386623d2ea70d2b5580295a

Source referenceLinux

git.kernel.org/stable/c/a9ff85886425355c72749be6090758aa19a89f16

Source referenceLinux

git.kernel.org/stable/c/81ee4df2a488f0909f7ff563e88a0e0099485a8b

Source referenceLinux

git.kernel.org/stable/c/2e6f60adf609c77e828f64e0cd371920bef91c12

Source referenceLinux

git.kernel.org/stable/c/56e25d716833604fd5bff388e472f290bfe793aa

Source referenceLinux

git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22

Source referenceLinux

View 2 more references

git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e

Source referenceLinux

git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873

Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification · not supplied

Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 5.10.273

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 5.15.224

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 6.12.112

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 6.18.53

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 7.2.7

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.29

After:

Through (inclusive):

Before: 7.3

Applicability preview

[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "5.10.273"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "5.15.224"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "6.12.112"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "6.18.53"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "7.2.7"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.29",
            "versionEndExcluding": "7.3"
          }
        ]
      }
    ]
  }
]

Contributing organizations · 1

Linux

Assigning organization

2026-10-30

Timeline

All times UTC

25 Sept 2026, 10:21
Advisory published
Publication date supplied by the source.
30 Oct 2026, 12:37
Source updated
Latest modification date supplied by the source.
30 Oct 2026, 14:00
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. No numeric assessment supplied.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

Record identifiers

Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-97537

Enrichment coverage

NVDNot fully checked

GHSANot fully checked

EUVDNot fully checked

EPSSNot fully checked

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON