Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queue

Impact

qla2xxx_delete_qpair() frees the request queue before releasing the response queue's MSI-X vector. In that window a response interrupt can still fire, queue qpair->q_work, and have qla24xx_process_response_queue() dereference the freed rsp->req on the LOGINOUT/CT/ELS and status paths. The cancel_work_sync() that was meant to cover this runs too late, in the response free path. The result is kernel memory corruption during Fibre Channel queue-pair teardown - which happens on adapter reset, port disruption or driver unload, not only on operator action. On a storage-attached GPU node this is an unplanned crash of a node whose in-flight training state is expensive to lose.

Who can reach it

Local and indirect - no tenant-reachable interface. It is a race triggered by FC adapter or fabric events (qpair teardown, adapter reset, driver unload) on hosts using QLogic FC HBAs; no authentication step applies.

What to do

Apply a stable kernel that releases the response-queue interrupt and flushes qpair->q_work before deleting the request queue. Kernel-image fix: drain and reboot each node with a QLogic FC HBA. Hosts without qla2xxx loaded need no action.

References

Related entries

• Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-freeCVE-2026-89861 · Linux kernel qla2xxx (qla24xx_report_id_acquisition vport reference)High
• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel KVM/arm64: guest-controlled TLBI Range can overflow the hypervisor's range computationCVE-2026-89911 · Linux kernel KVM arm64 (TLBI by Range)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh