CVE-2026-97532

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to

probe_hw_failed and calls qla2x00_mem_free(). Several error labels in

qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool,

flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info)

but left the pointers dangling. qla2x00_mem_free() then freed them a

second time. Worse, for the dma_pool members it issued

dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been

destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.

Clear each freed pointer (and its DMA handle) in the error labels so the

subsequent qla2x00_mem_free() skips them.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References