Linux qla2xxx: dying NPIV vport re-inserted into host_map during report ID acquisition, causing use-after-free

Impact

During NPIV vport teardown there is a window where qla24xx_report_id_acquisition() can still find the vport on vp_list and call qla_update_host_map(), re-inserting the dying vport into the host_map btree. Nothing removes that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. On a storage-attached node this is kernel memory corruption reachable from Fibre Channel fabric events rather than from any tenant workload - the trigger is a fabric ID-acquisition event racing a vport delete. The practical exposure is limited to fleets using QLogic FC HBAs with NPIV vports, but on those nodes the outcome is a kernel crash or worse on a host that carries live storage paths. Fixed by skipping vports with VPORT_DELETE set before taking the reference.

Who can reach it

Adjacent-network via the Fibre Channel fabric, combined with a concurrent NPIV vport deletion on the host. High complexity race; no host authentication involved. Not reachable at all on nodes without qla2xxx HBAs using NPIV.

What to do

Take the stable kernel update carrying the VPORT_DELETE guard (three stable commits referenced). Requires a kernel update and reboot per affected storage-attached node; the qla2xxx module cannot be swapped under active FC paths. Nodes with no QLogic FC HBA need no action.

References

Related entries

• Linux qla2xxx: pending qpair work runs after response queue teardown, causing use-after-freeCVE-2026-97536 · Linux kernel scsi/qla2xxx (queue pair teardown, qla25xx_free_rsp_que)High
• Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockupCVE-2026-98056 · Linux kernel nvme core (nvme_scan_ns_list stale-namespace removal)High
• Linux kernel libiscsi_tcp: a Data-In PDU naming a WRITE command's ITT overwrites the writer's own pagesCVE-2026-98479 · Linux kernel libiscsi_tcp (Data-In PDU direction check in iscsi_tcp_hdr_dissect)High
• Linux kernel nvmet: metadata SGL allocation failure frees the data SGL against an unassigned p2p deviceCVE-2026-98964 · Linux kernel nvmet (P2P device handling in nvmet_req_alloc_p2pmem_sgls error path)High
• Linux kernel ice: relaxed Tx doorbell write on arm64 trips a BUG_ON in dql_completed and panics the hostCVE-2026-98965 · Linux kernel ice driver (Tx doorbell MMIO ordering on arm64)High
• Linux kernel libiscsi: a malicious iSCSI target crashes the initiator with an unsolicited NOP-InCVE-2026-99152 · Linux kernel libiscsi (__iscsi_complete_pdu management-response task lookup)High