Linux qla2xxx: NULL dma_free and mismatched bitmap locking in multiqueue queue teardown

Impact

Two distinct defects in qla25xx_free_req_que()/qla25xx_free_rsp_que(), exposed by the queue-creation error path. First, when dma_alloc_coherent() fails the free function runs with req->ring / rsp->ring still NULL and calls dma_free_coherent() on a NULL cpu_addr, which can panic. Second, the free functions cleared req_qid_map / rsp_qid_map under vport_lock while the creators protect the same bitmaps with mq_lock, so there is no mutual exclusion; the create error path also cleared the bit and dropped mq_lock before calling free, leaving a window in which another thread allocates the same que_id and has its ha->req_q_map entry clobbered by the lockless NULL assignment. On a host using QLogic FC multiqueue this means a panic or corrupted queue mapping under concurrent queue setup. This is separate from the qla2x00_mem_alloc double free (CVE-2026-97532) - different functions, different fix. No CVSS score is given.

Who can reach it

Local and privileged: the paths run during driver queue creation and teardown. The race needs concurrent multiqueue create/free, and the NULL free needs a coherent-DMA allocation failure. No tenant or remote vector is described.

What to do

Take a stable kernel with the NULL ring guard and the mq_lock conversion (three stable commits listed) and reboot the affected FC hosts; fold it into a normal kernel maintenance window. The record names no distro fixed version.

References

Related entries

• Linux kernel io_uring: MSG_TRUNC recv over-advances the provided buffer ringCVE-2026-97618 · Linux kernel io_uring/net (provided buffer ring accounting with MSG_TRUNC)Unscored
• Linux kernel io_uring: deferred write accounting deadlocks a task against filesystem freezeCVE-2026-97619 · Linux kernel io_uring/rw (superblock write accounting released from task_work)Unscored
• Linux kernel x86/mm: pmd_modify() drops the dirty bit, losing written data on PMD-mapped THPCVE-2026-97945 · Linux kernel x86/mm pmd_modify() (hardware dirty bit dropped on PMD-mapped THP)Unscored
• Linux kernel powerpc/eeh: recursive locking hangs the EEH handler during PCI error recoveryCVE-2026-97948 · Linux kernel powerpc/eeh (recursive pci_rescan_remove_lock in eeh_rmv_device)Unscored
• Linux LIO iSCSI target: LUN_RESET on a WRITE_PENDING command deadlocks the target worker threadCVE-2026-97951 · Linux kernel SCSI target iSCSI frontend (aborted WRITE_PENDING dataout handling)Unscored
• Linux kernel RDS: congestion map scatterlist overruns on >8K page sizes, corrupting the RDS-TCP streamCVE-2026-97954 · Linux kernel net/rds (RDS-TCP congestion map scatterlist length)Unscored