Skip to main content

Linux Kernel EUVDEUVD-2026-86839

| CVE-2026-97531 HIGH
2026-09-25 Linux GHSA-pr28-3mcx-gcmr
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Local privileged access to FC/SAN host
  2. Delivery
    Initiate vport deletion via sysfs
  3. Exploit
    Race concurrent FC report-ID acquisition
  4. Install
    Dying vport re-inserted into host_map
  5. C2
    scsi_host_put() frees vha
  6. Execute
    Stale host_map lookup dereferences freed memory
  7. Impact
    Kernel UAF crash/corruption (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the qla2xxx driver with QLogic Fibre Channel HBA hardware and NPIV virtual ports (vports) in use. Exploitation depends on a race between a privileged vport-teardown operation (qla24xx_vport_delete via SCSI FC transport/sysfs, requiring root/CAP_SYS_ADMIN-level control) and an asynchronous FC fabric report-ID-acquisition event, hitting the narrow window between qla24xx_disable_vp() and qla24xx_deallocate_vp_id(). It is not remotely reachable and not triggerable by an unauthenticated actor; the FC-fabric timing dependency and privileged operation make reliable triggering difficult (AC:H).
Impact

This is a Linux kernel qla2xxx (QLogic Fibre Channel HBA) SCSI driver use-after-free caused by a race during virtual port (vport) teardown: qla24xx_report_id_acquisition() can re-insert a vport already marked VPORT_DELETE back into host_map, and a later host_map lookup dereferences memory freed by scsi_host_put(). The NVD CVSS 7.5 vector (AV:A/AC:H/PR:N/UI:N/C:H/I:H/A:H) is internally inconsistent with the mechanism: this is not an adjacent-network attack surface - the race is between an operator-initiated vport deletion (a privileged sysfs/FC-transport operation) and a Fibre Channel fabric report-ID-acquisition event, so AV:A and PR:N are not supportable and C:H/I:H overstate what is fundamentally a UAF crash/corruption. There is no EPSS, no CISA KEV entry, and no public POC; exploitation status is no public exploit identified at time of analysis. The 'high complexity' rating (AC:H) is the one metric that fits - this requires winning a narrow timing window between disable_vp() and deallocate_vp_id(). Net: despite the 7.5 'High' label, real-world risk is LOW - a driver-gated, race-conditioned, locally-triggered kernel DoS in a niche storage stack, not a remotely weaponizable memory-disclosure bug. The 'Information Disclosure' tag is a mislabel; primary impact is availability.
Exploit ScenarioDerived

On a server using QLogic Fibre Channel HBAs with NPIV virtual ports, a privileged operator (or automation) deletes a vport at the same moment the FC fabric drives a report-ID-acquisition event; the dying vport gets re-registered into host_map and, after the SCSI host is freed, a subsequent host_map lookup dereferences freed memory, crashing or corrupting the kernel. No public exploit code exists, and reliably hitting the window is difficult (AC:H).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Use-after-free in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets a local attacker with high privileges (root/CAP_SYS_ADMIN) race a virtual port (vport) teardown against an asynchronous fabric report-ID acquisition, causing qla24xx_report_id_acquisition() to re-insert a vport already marked VPORT_DELETE into host_map, so a later lookup dereferences memory freed by scsi_host_put(). The assessed impact is availability-high with integrity-low and no confidentiality impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), and exploitation requires the qla2xxx driver with NPIV vports in use; no public exploit has been identified at time of analysis.

RemediationAI

Apply the vendor-released patch by upgrading to Linux 6.18.53, 7.2.7, or 7.3-rc1 (or later) or by backporting the referenced stable commits d61e8de98c5a52978fb1edd95fe4dde3131b280e, 7a83979d92782f83c90888ebe19bdc9420521940, and 23582731afa35031c94fadb71a4f3b4afd094649; details are at https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e and the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-97531. If patching is not immediately possible, the main compensating control is to avoid using NPIV virtual ports on the qla2xxx HBA - unbind the qla2xxx driver or refrain from creating/deleting vports - though that disables the Fibre Channel HBA and its storage paths. Restricting root/CAP_SYS_ADMIN access to the SCSI FC transport/sysfs interfaces reduces the attack surface but does not eliminate the race for privileged administrators. Because the trigger depends on fabric timing and a privileged teardown operation, no light-touch configuration workaround fully removes the risk.

Affected VersionsENISA

Linux patch: 7.3-rc1
Linux 4.11
Linux patch: 0
Linux 41dc529a4602ac737020f423f84686a81de38e6d <23582731afa35031c94fadb71a4f3b4afd094649
Linux patch: 6.18.53
Linux patch: 7.2.7
Linux 41dc529a4602ac737020f423f84686a81de38e6d <d61e8de98c5a52978fb1edd95fe4dde3131b280e
Linux 41dc529a4602ac737020f423f84686a81de38e6d <7a83979d92782f83c90888ebe19bdc9420521940

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw is in the qla2xxx SCSI driver for QLogic Fibre Channel HBAs, specifically its NPIV virtual-port (vport) infrastructure. qla24xx_report_id_acquisition() walks ha->vp_list under vport_slock, takes a vref_count on a matching vport and calls qla_update_host_map() to register its port ID. During teardown, qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA), but the vport is not unlinked from vp_list until qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) without touching host_map. In the window between those steps, report ID acquisition can still find the vport and, seeing a zeroed d_id, take the btree_insert32() path to re-insert the dying vport into host_map; no later cleanup removes that entry, so once scsi_host_put() frees the vha a subsequent host_map lookup dereferences freed memory. The provided data does not assign a CWE, but the root-cause class is a use-after-free (CWE-416) arising from a race condition (CWE-362) between asynchronous fabric event handling and a privileged deletion operation. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the Linux kernel as the affected product.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.7 MEDIUM

Local privileged vport delete racing an FC fabric event (AV:L/PR:H/AC:H); UAF yields kernel crash/corruption (A:H, I:L) with no disclosure (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:21 cve.org
HIGH 7.5
CVE Published
Sep 25, 2026 - 10:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Skip vport under deletion in report ID acquisition

qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id.

A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory.

Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().

Executive ViewAI

Why It Matters

A high-severity use-after-free flaw in the Linux kernel’s qla2xxx driver for QLogic Fibre Channel HBAs could let a local attacker with root or CAP_SYS_ADMIN privileges crash or destabilize systems that use NPIV virtual ports, disrupting storage connectivity. Because exploitation requires high privileges and specific hardware/driver configuration, the primary business risk is availability loss on critical SAN-attached Linux servers rather than broad compromise; a vendor patch is available. No public exploit has been identified at time of analysis.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Prevalence
Low
QLogic Fibre Channel HBA driver, niche datacenter SAN storage only
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97531 ADVISORY https://vuldb.com/vuln/409925 REF https://git.kernel.org/stable/c/20bb54601d2655e83795b73499c89f6b1cb31016 REF https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649 REF https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940 REF https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy