HIGH Introduced in 4.11
qla2xxx VportDelete UAF
CVE-2026-97531
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().
02KernelScan AI Analysis
Risk summary
A local privileged user with a QLogic Fibre Channel adapter can trigger a use-after-free by racing vport deletion with the hardware's report-ID-acquisition path, causing the kernel to dereference freed memory. The bug requires root or CAP_SYS_ADMIN to initiate vport teardown and winning a timing window, but results in kernel memory corruption that can crash or compromise the host.
Vulnerability analysis
During teardown of a virtual port in the QLogic Fibre Channel driver, the port is removed from the internal device map and marked for deletion, but remains on the adapter's active list until a later cleanup step. If the hardware reports a port identifier during that window, the driver finds the dying port and re-inserts it into the device map with a zeroed address, leaving a stale entry that is never removed. Once the port structure is freed, any later lookup in that map dereferences freed memory. The fix skips ports already marked for deletion before taking a reference, so a dying port is never re-registered. The vulnerable path is reachable only on systems with the QLogic Fibre Channel adapter, loaded driver, and configured virtual ports, and the race is triggered by a privileged local user performing port deletion.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.11 | 6.12.112 | 20bb54601d26 |
| 6.18 | 4.11 | 6.18.53 | d61e8de98c5a |
| 7.2 | 4.11 | 7.2.7 | 7a83979d9278 |
| mainline | 4.11 | 7.3-rc1 | 23582731afa3 |