Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work() dereferences the qpair (vha, rsp) and takes qpair->qp_lock. During teardown, qla2xxx_delete_qpair() deletes the response queue, which calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and the qpair. free_irq() waits for running hardirq handlers but does not cancel work already placed on ha->wq. A still-pending q_work then runs qla_do_work() against the freed qpair and response queue, causing a use-after-free. This is especially likely during full adapter teardown, where destroy_workqueue(ha->wq) forces pending work to run after the queue pairs have been freed. Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que() after free_irq() has released the interrupt (so no new work can be queued) and before the response queue and qpair memory are freed (so the flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq to match the INIT_WORK() condition and avoid operating on an uninitialized work_struct.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T11:17:03.863Z",
  "pubdate": "2026-09-25T11:17:03.863Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel qla2xxx SCSI driver, specifically within the queue pair (qpair) teardown sequence.\nThe vulnerability arises due to a race condition between the interrupt handler and the workqueue cleanup process during the deletion of a response queue.\nAn attacker capable of triggering adapter teardown or causing specific device state transitions could exploit this race condition to achieve a use-after-free, potentially leading to system instability, kernel panics, or arbitrary code execution.\nThe flaw affects systems using the qla2xxx driver, particularly during full adapter teardown or when response queues are dynamically deleted.\nExploitation requires the ability to trigger the teardown logic while the driver is actively processing work items. The risk is considered high due to the potential for kernel-mode memory corruption.",
  "technicalDetails": "The vulnerability resides in the qla2xxx driver's handling of the asynchronous work item q_work, which is scheduled by the qla2xxx_msix_rsp_q() MSI-X interrupt handler via the ha->wq workqueue.\nDuring the teardown phase triggered by qla2xxx_delete_qpair(), the function qla25xx_free_rsp_que() is invoked. This sequence includes a call to free_irq(), which effectively disables the MSI-X interrupt handler but does not guarantee the cancellation of pending work items already queued on ha->wq.\nBecause free_irq() does not perform an implicit flush or cancellation of pending work, the q_work item remains in the workqueue. If the execution of qla25xx_free_rsp_que() continues, it proceeds to deallocate the memory associated with the response queue and the qpair structure.\nIf the scheduler later executes the pending q_work, it invokes qla_do_work(). This function attempts to dereference the now-freed qpair and response queue structures to access their respective lock primitives (qpair->qp_lock).\nFurthermore, during full adapter teardown, the system calls destroy_workqueue(ha->wq), which forces all remaining pending work items to run against the already-freed memory, drastically increasing the probability of a successful exploit.\nThe exploitation flow follows these steps: 1) The target initiates a teardown of the qpair. 2) The driver calls free_irq(), releasing the MSI-X handler. 3) The driver deallocates the qpair memory. 4) The kernel scheduler executes the stale q_work item from the workqueue. 5) The execution flow hits the freed memory in qla_do_work(), resulting in a kernel-space use-after-free condition.\nThis vulnerability is critical because it involves kernel memory management. A successful exploitation likely leads to a denial of service through a system crash; however, if the memory is reallocated by the kernel allocator (SLUB/SLAB) before the stale work item executes, an attacker might be able to overwrite sensitive control structures, potentially leading to privilege escalation or kernel code execution."
}