CVE-2026-97537

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing

bugs exposed on the error path of qla25xx_create_{req,rsp}_que():

1. When dma_alloc_coherent() fails during queue creation, the error

path calls the free function with req->ring / rsp->ring still NULL

(from kzalloc). The unconditional dma_free_coherent() with a NULL

cpu_addr is undefined behavior and can panic.

2. The free functions clear req_qid_map / rsp_qid_map under vport_lock,

but the create functions protect the same bitmaps with mq_lock.

This provides no mutual exclusion. Additionally, the create error

path clears the bit and releases mq_lock before calling the free

function, creating a window where another thread can allocate the

same que_id and have its ha->req_q_map entry clobbered by the

subsequent lockless NULL assignment in th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References