{"id":"CVE-2026-97531","state":"PUBLISHED","title":"scsi: qla2xxx: Skip vport under deletion in report ID acquisition","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps().","publishedAt":"2026-09-25T10:21:31.968Z","updatedAt":"2026-10-30T12:37:12.533Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"d3ac7e0f454c7d52c0c2e5ecaf5a3d938f1b166d","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"40dcd4a71a52414b47fbba2f956387f1077c6c15","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"20bb54601d2655e83795b73499c89f6b1cb31016","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"d61e8de98c5a52978fb1edd95fe4dde3131b280e","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"7a83979d92782f83c90888ebe19bdc9420521940","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"23582731afa35031c94fadb71a4f3b4afd094649","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.11","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.7","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"]}],"references":["https://git.kernel.org/stable/c/d3ac7e0f454c7d52c0c2e5ecaf5a3d938f1b166d","https://git.kernel.org/stable/c/40dcd4a71a52414b47fbba2f956387f1077c6c15","https://git.kernel.org/stable/c/20bb54601d2655e83795b73499c89f6b1cb31016","https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e","https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940","https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649"],"weaknesses":[],"ingestedAt":"2026-10-30T12:56:04.490Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/97xxx/CVE-2026-97531.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97531","state":"PUBLISHED","datePublished":"2026-09-25T10:21:31.968Z","dateUpdated":"2026-10-30T12:37:12.533Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-24T16:01:01.153Z"},"containers":{"cna":{"title":"scsi: qla2xxx: Skip vport under deletion in report ID acquisition","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"d3ac7e0f454c7d52c0c2e5ecaf5a3d938f1b166d","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"40dcd4a71a52414b47fbba2f956387f1077c6c15","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"20bb54601d2655e83795b73499c89f6b1cb31016","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"d61e8de98c5a52978fb1edd95fe4dde3131b280e","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"7a83979d92782f83c90888ebe19bdc9420521940","versionType":"git"},{"version":"41dc529a4602ac737020f423f84686a81de38e6d","status":"affected","lessThan":"23582731afa35031c94fadb71a4f3b4afd094649","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.11","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.7","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_mbx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d3ac7e0f454c7d52c0c2e5ecaf5a3d938f1b166d"},{"url":"https://git.kernel.org/stable/c/40dcd4a71a52414b47fbba2f956387f1077c6c15"},{"url":"https://git.kernel.org/stable/c/20bb54601d2655e83795b73499c89f6b1cb31016"},{"url":"https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e"},{"url":"https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940"},{"url":"https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The patched format-1 (vp_idx != 0) path in qla24xx_report_id_acquisition() walks ha->vp_list and calls qla_update_host_map() when a VP_RPT_ID_IOCB_TYPE for FDISC complete or VP_STAT_ID_CHG arrives via qla24xx_process_response_queue() from qla24xx_intr_handler/qla24xx_msix_rsp_q, or via qlt_24xx_atio_pkt_all_vps(). A Fibre Channel SAN peer or switch induces those RIDAs; native FC/FCoE is a non-routable L2 fabric, so Adjacent.\nAC:H - The stale host_map insert happens only after qla24xx_vport_delete() sets VPORT_DELETE and qla24xx_disable_vp() RESET_AL_PA zeroes d_id and drops the vport from host_map, but before qla24xx_deallocate_vp_id() unlinks it from vp_list. A fabric attacker cannot write the S_IWUSR sysfs store_fc_vport_delete attribute to start that teardown, so the window is a victim state they cannot induce.\nPR:N - VP_RPT_ID handling in qla24xx_process_response_queue() and qlt_24xx_atio_pkt_all_vps() is an unauthenticated firmware completion of fabric N_Port ID assignment; that interrupt path checks no Linux uid or capability. FC-SP/EDIF is opt-in and is not required to deliver a format-1 RIDA.\nUI:N - Format-1 RIDA is processed automatically in interrupt context when firmware reports a VP ID. Concurrent qla24xx_vport_delete() is an administrator NPIV teardown rather than a mount, open, or other interactive step the attacker solicits.\nS:U - The dangling scsi_qla_host pointer is stored in ha->host_map and later consumed in the same host kernel by qla_find_host_by_d_id(); this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After scsi_host_put() at the end of qla24xx_vport_delete() frees the vha, a later btree_lookup32() in qla_find_host_by_d_id() on the re-inserted host_map key returns the freed scsi_qla_host. That use-after-free enables disclosure of reused heap contents.\nI:H - With d_id already zeroed, qla_update_host_map() takes btree_insert32() and plants the dying vha into ha->host_map. Later ATIO/ELS dispatch via qla_find_host_by_d_id() writes through that freed scsi_qla_host, giving a kernel write and control-flow primitive.\nA:H - A later host_map lookup of the freed vha from qlt_24xx_atio_pkt_all_vps() (ATIO_TYPE7 d_id) or qla_edif ELS handling oopses in interrupt context, panicking the storage host even without a full exploit."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:37:12.533Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}