Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-free

Impact

In the format 1 path of qla24xx_report_id_acquisition(), the driver finds a virtual port on ha->vp_list under vport_slock, drops the lock, then keeps using the vport - calling qla_update_host_map() and setting VP_IDX_ACQUIRED, REGISTER_FC4_NEEDED and REGISTER_FDMI_NEEDED on it - without holding a reference. A concurrent qla24xx_deallocate_vp_id() can free the vport in that window, so the driver writes into freed memory. This affects NPIV deployments, which is how many operators carve one FC HBA into per-tenant or per-workload virtual ports; the corruption is in the host kernel, so the blast radius is the whole node, not one initiator.

Who can reach it

Local and indirect - driven by FC fabric events and concurrent NPIV vport creation/teardown on hosts with QLogic FC HBAs using virtual ports. No tenant-facing interface and no authentication step.

What to do

Update to a stable kernel that takes vref_count under vport_slock for the matching vport and drops it after the last use. Kernel-image fix, so it means draining and rebooting each affected node. Only hosts running qla2xxx with NPIV virtual ports are exposed; the rest can wait for a normal patch cycle.

References

Related entries

• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel KVM/arm64: guest-controlled TLBI Range can overflow the hypervisor's range computationCVE-2026-89911 · Linux kernel KVM arm64 (TLBI by Range)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh