CVE-2026-97536 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use the qla2xxx SCSI driver should assess their exposure and apply the patch to prevent potential use-after-free errors. This includes reviewing the affected scope, severity, and vendor guidance, as well as planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

A use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver could lead to system instability or potential elevation of privileges. Linux kernel developers and administrators should assess their exposure and apply the patch to prevent potential use-after-free errors.

• Potential system crashes or instability due to use-after-free errors
• Possible elevation of privileges or unauthorized access
• Required review and application of patches to prevent exploitation

Technical summary

The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. To fix the vulnerability, the work item is flushed with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt, ensuring that the flushed handler still sees valid memory.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Ensure that the Linux kernel is up-to-date with the latest security patches
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved in the Linux kernel by flushing the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt. This change ensures that no new work can be queued and that the flushed handler still sees valid memory, thus preventing the use-after-free error. The fix involves modifying the qla25xx_free_rsp_que() function to include the cancel_work_sync() call, which synchronously cancels the work item and prevents it from running against the freed qpair.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.