Linux Kernel EUVD-2026-86836

Requires the qla2xxx driver bound to a QLogic Fibre Channel HBA operating on the NVMe-over-Fibre-Channel path, and the specific LS-reject error branch in qla_nvme_xmt_ls_rsp() to be taken while a uctx is linked in fcport->unsol_ctx_head (populated by qla2xxx_process_purls_iocb from unsolicited purex LS traffic). Limiting factors: exploitation depends on FC fabric interaction and an error/reject condition on the LS response path rather than a directly attacker-chosen input, so triggering is not reliable; the host must have this driver and NVMe-oF FC transport in use, which is uncommon outside enterprise SAN environments. Not exploitable against default desktop/server configurations lacking FC HBAs.

The input CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8 High) substantially overstates real-world risk. This is a CWE-416 use-after-free / linked-list corruption on an *error path* in the qla2xxx SCSI-to-NVMe (NVMe-over-Fibre-Channel) driver: on the LS-reject error branch, qla_nvme_xmt_ls_rsp() kfree()s the uctx without list_del()-ing it from fcport->unsol_ctx_head, so a later list_add_tail()/list_del() writes through freed memory and can panic or corrupt the list. The realistic technical impact is a kernel crash / memory corruption (denial of service), not confidentiality loss - so C:H/I:H is not supported and the practical outcome is A:H-dominant. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data (no public exploit identified at time of analysis). The AV:A rating presumably reflects that the unsolicited LS originates from the Fibre Channel fabric, but the bug lives on a reject/error handling path that is not straightforwardly attacker-steerable, so exploitability is closer to AC:H and effectively a reliability defect. Net: this is a legitimate kernel fix but a low-to-medium operational priority, well below what the 8.8 score implies.

On a host running the qla2xxx driver with a QLogic Fibre Channel HBA acting as an NVMe-over-FC initiator/target, an unsolicited Link Service request from the FC fabric is processed and linked into fcport->unsol_ctx_head, but the NVMe transport callback hits the LS-reject error path, which frees the context while it is still on the list. Subsequent list operations for that fcport then dereference or overwrite freed memory, causing list corruption or a kernel panic. No public exploit code exists; realistic triggering depends on fabric/transport error conditions rather than a reliable attacker-controlled primitive.