Strix
75K

CVE-2026-97532

UnknownEPSS 0.21%

Last modified

CVE-2026-97532 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.

Metrics

EPSS Probability
0.21%

10.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d64d6c5671db5e693a0caaee79f2571b098749c9, < e6732abc33c41772192ef8717354a5574a5c2ebf; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < aea0901d35beb3acc8a4086fb00c5b9c0e9c83ab; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < d3dee064ab9d705f6f652c639c55d7ea74df87cc; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < 5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < 84f5de696b8c924aeb4bf430a0bdc762fc50e99f; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < a57570229edb7a0990d5c8067daeb9ac8858a961; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < 286d9594a022dd7e0caa3de9daa63b896bc70d43; >= d64d6c5671db5e693a0caaee79f2571b098749c9, < 6d90f0feb929f6c0f3010f9af4747c7230b75993; 8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc; 7142b10b87d5b393a0688358b16a4b1d3680ec7d; >= 4.14.27, < 4.15; >= 4.15.10, < 4.16
LinuxLinux4.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97532?
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.
How severe is CVE-2026-97532?
Severity scoring for CVE-2026-97532 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-97532?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97532?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST