CVE-2026-97536

A use-after-free flaw was found in the Linux kernel's qla2xxx Fibre Channel driver, rated Moderate severity by Red Hat Product Security. When a response queue is deleted during queue or full adapter teardown, work already queued on the driver workqueue is not canceled before the response queue and queue pair memory are freed. If that pending work subsequently executes, it dereferences the freed qpair and response queue structures, which can cause a kernel crash resulting in a denial of service, or potentially memory corruption. Exploitation requires local access with administrative privileges, for example to unbind the device, reset the adapter, or unload the driver, and also depends on winning a race between the queued work and the teardown path. Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform releases that ship affected kernel builds are listed as affected. The fix is currently deferred for these streams, so the residual denial-of-service or memory-corruption risk remains until a fix is released. The CVE.org severity of Important differs from Red Hat's Moderate rating because Red Hat's assessment accounts for the administrative privilege requirement and the high attack complexity, which reduce practical exploitability relative to the upstream scoring.