HIGH Introduced in 2.6.31
qla2xxx QpairWork UAF
CVE-2026-97536
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct.
02KernelScan AI Analysis
Risk summary
A use-after-free race condition exists in the QLogic Fibre Channel HBA driver during response queue teardown. A local attacker with root privileges who triggers adapter or queue teardown while I/O completions are pending can cause deferred work to execute against freed queue-pair memory, potentially leading to kernel crash or memory corruption. Systems without a qla2xxx HBA are not affected.
Vulnerability analysis
A race condition exists in the QLogic Fibre Channel HBA driver's response queue teardown path. When an interrupt handler schedules deferred work for processing I/O completions, and the adapter's response queue is simultaneously torn down, the deferred work can run after the queue and its associated data structures have been freed, causing a use-after-free. The fix adds a synchronization step that cancels any pending work item after the interrupt is released but before the queue memory is freed, ensuring the work handler never runs against freed memory. The vulnerability is local and requires a QLogic FC adapter to be present; triggering the teardown path that creates the race window requires root-level access to the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.31 | 6.12.112 | dd6c14db0dbb |
| 6.18 | 2.6.31 | 6.18.53 | 1710a69fd74d |
| 7.2 | 2.6.31 | 7.2.7 | f1f4d1cb93ee |
| mainline | 2.6.31 | 7.3-rc1 | 19788a55cab6 |