CVE-2026-97537

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Issues exist in the qla2xxx SCSI driver within the qla25xx free req que() and qla25xx free rsp que() functions, which are triggered during the error path of qla25xx create req que() and qla25xx create rsp que(). First, if dma alloc coherent() fails, the system may call dma free coherent() with a NULL pointer for req->ring or rsp->ring, leading to undefined behavior and potential system panics. Second, a locking inconsistency occurs because the free functions use vport lock to clear req qid map and rsp qid map, while the create functions use mq lock. This lack of mutual exclusion, combined with the release of mq lock before calling the free function, creates a race condition where another thread could allocate the same que id, resulting in the ha->req q map entry being overwritten.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.