CVE-2026-97532

CVE CVE-2026-97532EUVD EUVD-2026-86840Published 2026-09-25T10:21:32.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <286d9594a022dd7e0caa3de9daa63b896bc70d43; 0 <7.2.7; patch: 6.18.53; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6d90f0feb929f6c0f3010f9af4747c7230b75993; 0 <6.18.53; patch: 7.3-rc1; patch: 7.2.7; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a57570229edb7a0990d5c8067daeb9ac8858a961

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.