HIGH Introduced in 6.6
scsi UnsolCtx UAF
CVE-2026-97528
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic. Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.
02KernelScan AI Analysis
Risk summary
A use-after-free in the QLogic Fibre Channel NVMe driver allows a remote node on the same FC SAN fabric to corrupt kernel heap memory by sending unsolicited LS requests that trigger an error response path. The freed context object remains linked in a per-port list, and subsequent list operations write through the dangling pointer, potentially causing kernel panics or exploitable memory corruption. Any host with a QLogic FC adapter running NVMe over FC and a kernel since 6.6 is affected.
Vulnerability analysis
When the QLogic Fibre Channel driver processes an unsolicited NVMe Link Service request and later attempts to transmit the response, an error cleanup path frees the request context object without first removing it from the per-port linked list. The next list operation on that port writes through the freed node, corrupting kernel heap memory and potentially panicking the system. The fix adds the missing list removal before the free on the error path, so the object is unlinked before it is released — matching the cleanup already done on other code paths. The bug is reachable from the Fibre Channel fabric: a remote node sending crafted LS requests can trigger the error path on any host whose qla2xxx driver has NVMe over FC enabled, with no local privileges required. Systems without QLogic FC hardware or without FC-NVMe configured are not affected.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.6 | 6.12.112 | cbbf1484496a |
| 6.18 | 6.6 | 6.18.53 | a95fc5f1c12b |
| 7.2 | 6.6 | 7.2.7 | c55d649a6cc2 |
| mainline | 6.6 | 7.3-rc1 | e46160a5d4fa |