Linux qla2xxx: double free and NULL dma_pool use when adapter memory allocation fails at probe

Impact

When qla2x00_mem_alloc() fails, its error labels freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) without clearing the pointers, and qla2x00_probe_one() then called qla2x00_mem_free(), which freed them a second time. For the DMA pool members it also called dma_pool_free() against ha->s_dma_pool after that pool had been destroyed and set to NULL, dereferencing a NULL pool. The practical outcome is a kernel crash or heap corruption during Fibre Channel HBA probe on hosts that use QLogic adapters for their SAN or shared scratch storage - an availability and integrity problem at boot or driver load, not something a tenant reaches. No CVSS score is provided.

Who can reach it

Not attacker-reachable in any way the record describes: the path requires an allocation failure inside qla2x00_mem_alloc(), i.e. memory exhaustion during device probe or driver load. Local root at most.

What to do

Roll a stable kernel that clears the freed pointers and DMA handles in the error labels (three stable commits listed) and reboot the affected storage-attached hosts. Treat it as routine kernel hygiene rather than an emergency window. No distro fixed version appears in the record.

References

Related entries

• Linux kernel qla2xxx: NPIV virtual-port index above 128 writes past the VP control IOCB bitmapCVE-2026-97535 · Linux kernel qla2xxx (VP_CTRL IOCB vp_idx_map bounds)Unscored
• Linux qla2xxx: NULL dma_free and mismatched bitmap locking in multiqueue queue teardownCVE-2026-97537 · Linux kernel scsi qla2xxx (multiqueue req/rsp queue teardown, qid bitmap locking)Unscored
• Linux kernel io_uring: MSG_TRUNC recv over-advances the provided buffer ringCVE-2026-97618 · Linux kernel io_uring/net (provided buffer ring accounting with MSG_TRUNC)Unscored
• Linux kernel io_uring: deferred write accounting deadlocks a task against filesystem freezeCVE-2026-97619 · Linux kernel io_uring/rw (superblock write accounting released from task_work)Unscored
• Linux kernel x86/mm: pmd_modify() drops the dirty bit, losing written data on PMD-mapped THPCVE-2026-97945 · Linux kernel x86/mm pmd_modify() (hardware dirty bit dropped on PMD-mapped THP)Unscored
• Linux kernel powerpc/eeh: recursive locking hangs the EEH handler during PCI error recoveryCVE-2026-97948 · Linux kernel powerpc/eeh (recursive pci_rescan_remove_lock in eeh_rmv_device)Unscored