CVE-2026-97537
Description
A flaw was found in the Linux kernel's qla2xxx driver. A local user could cause a Denial of Service (DoS) through a system crash during device queue teardown. This issue occurs when error handling paths fail to properly synchronize queue state and attempt to deallocate memory pointers that were never initialized.
Statement
A Moderate-impact flaw was found in the Linux kernel's qla2xxx Fibre Channel driver as shipped in Red Hat Enterprise Linux and RHEL CoreOS-based products. Two defects in the queue teardown error path can cause a local denial of service: when a DMA allocation fails during request/response queue creation, the error path unconditionally calls dma_free_coherent() on a still-NULL ring pointer, which is undefined behavior and can panic the kernel; and the queue creation and destruction paths protect the shared queue-ID bitmaps with different locks (mq_lock and vport_lock), so a race can clear another thread's newly installed queue map entry and leave the adapter in an inconsistent state. A local user able to trigger queue creation failure or concurrent queue create/teardown operations on a qla2xxx adapter could use this to crash the system or disrupt I/O. There is no impact to confidentiality or integrity. Red Hat assigned a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, and the OpenShift Container Platform streams based on RHCOS 8 and RHCOS 9 are affected; RHEL 6 Extended Lifecycle Support is out of support scope and is not receiving a fix. Because the flaw only affects availability, requires local access, and depends on low-probability error or race conditions, fixes are deferred to a future scheduled update of the affected products rather than an urgent update; the residual risk is limited to a local denial of service on systems using affected qla2xxx hardware.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
