Linux qla2xxx: pending qpair work runs after response queue teardown, causing use-after-free

Impact

The MSI-X response-queue handler schedules qla_do_work() on the driver workqueue, but queue-pair teardown calls free_irq() and then frees the response queue and qpair without cancelling work already queued. free_irq() waits only for running hardirq handlers, so a still-pending work item dereferences the freed qpair and response queue. This is most likely during full adapter teardown, where destroy_workqueue() forces pending work to run after the queue pairs are gone - meaning a driver unload or adapter reset on a storage-attached node can corrupt kernel memory. This is a distinct bug from the vport re-registration use-after-free in the same driver and has its own fix. Resolved by adding cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() and before the memory is released.

Who can reach it

Adjacent-network fabric traffic driving response-queue interrupts, racing a local queue-pair or adapter teardown. High complexity; requires QLogic FC hardware on the node. No authentication is involved.

What to do

Take the stable kernel update carrying the cancel_work_sync() fix (three stable commits referenced). Kernel update and reboot per affected node; in the meantime avoid unnecessary qla2xxx unloads and adapter resets on production storage nodes. Nodes without QLogic FC HBAs are unaffected.

References

Related entries

• Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockupCVE-2026-98056 · Linux kernel nvme core (nvme_scan_ns_list stale-namespace removal)High
• Linux kernel libiscsi_tcp: a Data-In PDU naming a WRITE command's ITT overwrites the writer's own pagesCVE-2026-98479 · Linux kernel libiscsi_tcp (Data-In PDU direction check in iscsi_tcp_hdr_dissect)High
• Linux kernel nvmet: metadata SGL allocation failure frees the data SGL against an unassigned p2p deviceCVE-2026-98964 · Linux kernel nvmet (P2P device handling in nvmet_req_alloc_p2pmem_sgls error path)High
• Linux kernel ice: relaxed Tx doorbell write on arm64 trips a BUG_ON in dql_completed and panics the hostCVE-2026-98965 · Linux kernel ice driver (Tx doorbell MMIO ordering on arm64)High
• Linux kernel libiscsi: a malicious iSCSI target crashes the initiator with an unsolicited NOP-InCVE-2026-99152 · Linux kernel libiscsi (__iscsi_complete_pdu management-response task lookup)High
• OpenSSL: ChaCha20-Poly1305 accepts 16-byte nonces, silently ignoring leading bytesCVE-2019-1543 · OpenSSL (ChaCha20-Poly1305 variable nonce length)High