Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic. Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T11:17:02.980Z",
  "pubdate": "2026-09-25T11:17:02.980Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel qla2xxx SCSI driver, specifically within the NVMe Link Service (LS) response handling logic. The vulnerability arises from an improper cleanup sequence during error path execution in qla_nvme_xmt_ls_rsp().\nAn attacker capable of triggering specific error conditions during NVMe LS transmissions can cause the kernel to retain a reference to a freed memory object within a linked list (fcport->unsol_ctx_head).\nThis flaw can lead to kernel memory corruption, system instability, or potential arbitrary code execution if the corrupted list pointers are manipulated. The vulnerability affects systems utilizing the qla2xxx driver for Fibre Channel NVMe offloads. Exploitation requires the ability to interact with the NVMe transport layer, typically from a local or privileged context, to induce failure states in the response path.\nThe risk is categorized as high due to the potential for kernel-mode memory corruption, which necessitates prompt patching of the affected kernel subsystem to prevent denial-of-service or escalation vectors.",
  "technicalDetails": "The root cause of this vulnerability is a reference management error in qla_nvme_xmt_ls_rsp() within the qla2xxx driver. The function retrieves an unsol_ctx (uctx) structure, which is tracked in a list (fcport->unsol_ctx_head) populated by qla2xxx_process_purls_iocb().\nWhen an LS response transmission encounters an error and branches to the 'out:' label, the function correctly invokes kfree(uctx) to release the allocated memory. However, it fails to perform a list_del() operation prior to freeing the memory. Consequently, the fcport->unsol_ctx_head list retains a pointer to the now-deallocated address.\nThe exploitation flow proceeds as follows: First, the attacker triggers an NVMe LS request that results in an error condition within the qla_nvme_xmt_ls_rsp() error handling path. The kernel executes the 'out:' label, freeing the uctx memory while leaving the dangling pointer inside the fcport list. Second, subsequent legitimate traffic or management operations call list_add_tail() or other list operations on the same fcport. Because the list still contains the stale pointer, the driver performs a write operation through this freed node. This leads to heap corruption, as the kernel modifies memory that has potentially been reclaimed and repurposed by other kernel subsystems.\nThe vulnerability occurs because the 'out:' path is identified as the sole location where the uctx is freed without being unlinked. Other release points in the driver (specifically qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt()) correctly manage the list structure. The lack of proper synchronization and cleanup creates a classic Use-After-Free (UAF) condition. The impact is significant: the corruption of linked list pointers (prev/next) can lead to kernel panic (Denial of Service) when subsequent list traversals occur (e.g., list_del()). In an adversarial context, if the memory allocator reuses the freed buffer for sensitive structures (like function pointers or object headers), an attacker might achieve control over the kernel's execution flow. No specific network exposure is required beyond the ability to interact with the Fibre Channel NVMe subsystem, often implying local user privilege or specific infrastructure access."
}