{"id":"CVE-2026-97536","summary":"scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown\n\nThe response queue MSI-X handler qla2xxx_msix_rsp_q() schedules\nqla_do_work() via queue_work(ha-\u003ewq, &qpair-\u003eq_work). qla_do_work()\ndereferences the qpair (vha, rsp) and takes qpair-\u003eqp_lock.\n\nDuring teardown, qla2xxx_delete_qpair() deletes the response queue, which\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and\nthe qpair. free_irq() waits for running hardirq handlers but does not\ncancel work already placed on ha-\u003ewq. A still-pending q_work then runs\nqla_do_work() against the freed qpair and response queue, causing a\nuse-after-free. This is especially likely during full adapter teardown,\nwhere destroy_workqueue(ha-\u003ewq) forces pending work to run after the queue\npairs have been freed.\n\nFlush the work item with cancel_work_sync() in qla25xx_free_rsp_que()\nafter free_irq() has released the interrupt (so no new work can be\nqueued) and before the response queue and qpair memory are freed (so the\nflushed handler still sees valid memory). Guard on rsp-\u003eqpair and ha-\u003ewq\nto match the INIT_WORK() condition and avoid operating on an\nuninitialized work_struct.","modified":"2026-09-26T03:48:36.540638174Z","published":"2026-09-25T10:21:34.991Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97536.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1710a69fd74d0b4bdfcc57c3309b1c4057f70d85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/19788a55cab61d78e33e0914a5a31d27843e8a4a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1f4d1cb93eeeb250eac9405121933e268eefbd3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97536.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97536"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"68ca949cdb04b4dc71451a999148fbc5f187a220"},{"fixed":"1710a69fd74d0b4bdfcc57c3309b1c4057f70d85"},{"fixed":"f1f4d1cb93eeeb250eac9405121933e268eefbd3"},{"fixed":"19788a55cab61d78e33e0914a5a31d27843e8a4a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97536.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.31"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97536.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}