Linux Kernel EUVD-2026-86844

Requires the qla2xxx QLogic Fibre Channel HBA driver to be loaded on hardware with a configured response queue and MSI-X interrupts, and exploitation is gated on winning a teardown race: a pending qla_do_work() item must remain on ha->wq at the moment qla2xxx_delete_qpair()/qla25xx_free_rsp_que() frees the qpair and response queue (most reliably during full-adapter teardown via destroy_workqueue). The teardown itself is a privileged local operation (module unload, device removal, HBA reconfiguration), so exploitation is not remotely reachable by an unauthenticated attacker despite the NVD AV:A/PR:N vector; the narrow, timing-dependent window and privilege requirement substantially limit real-world exploitability, and the practical outcome is a kernel crash.

This is a use-after-free (CWE-416) in the Linux kernel qla2xxx QLogic Fibre Channel HBA driver, triggered on response-queue/qpair teardown when a still-pending workqueue item (qla_do_work) runs against freed qpair/rsp memory. NVD scores it 7.5 with vector AV:A/AC:H/PR:N/UI:N/C:H/I:H/A:H, but this vector overstates real-world risk. The bug is a teardown/removal race - it fires during qla2xxx_delete_qpair() or full-adapter destroy_workqueue(), which are privileged local administrative operations (module unload, device removal, HBA reconfiguration), not something a remote or network-adjacent attacker drives. PR:N is therefore questionable (teardown requires privileged control) and the C:H/I:H/A:H triad is not supported by the description, which describes a UAF whose realistic outcome is a kernel crash/DoS rather than confirmed information disclosure or code execution. There is no EPSS score, no CISA KEV listing, and no public exploit - the CVE originates from a routine upstream stable-tree fix. Note the conflict: NVD's AV:A/PR:N suggests network-adjacent unauthenticated reach, whereas the code path implies a local, privileged, hard-to-win race - verify against the actual trigger conditions. Overall this is a low real-world priority, high-CVSS-but-low-practical-risk hygiene fix typical of kernel driver teardown races.

A local operator (or automated management path) tears down qla2xxx queue pairs - via HBA hot-removal, driver module unload, or adapter reconfiguration - while an MSI-X response interrupt has already queued qla_do_work() on ha->wq. free_irq() releases the IRQ but does not cancel the pending work, so after the qpair and response queue are freed the work item dereferences freed memory, most likely crashing the kernel. No public proof-of-concept exists and the race window is narrow, making reliable exploitation for anything beyond denial of service unlikely.