CVE-2026-97528

A flaw was found in the Linux kernel's qla2xxx driver. This vulnerability allows an attacker on the storage network to cause a Denial of Service (DoS) or memory corruption. When an error occurs during the handling of Non-Volatile Memory Express (NVMe) Link Service responses, the driver releases an internal context structure without unlinking it from an active tracking list. Subsequent list operations access or modify this freed memory, potentially resulting in a system crash.

This vulnerability is rated as an Important severity flaw because kernel memory corruption can be triggered during storage transport failures, directly destabilizing the operating system. Exposure is restricted to deployments equipped with QLogic Fibre Channel Host Bus Adapters (HBAs) configured for NVMe over Fibre Channel (NVMe-oFC). Hosts without this specific hardware or those not utilizing NVMe over fabrics protocols do not execute the susceptible driver logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the qla2xxx kernel module from loading if QLogic Fibre Channel Host Bus Adapters (HBAs) or NVMe over Fibre Channel are not required on the system:

1. Blacklist the module by creating a configuration file:

echo "blacklist qla2xxx" >> /etc/modprobe.d/blacklist-qla2xxx.conf

2. Prevent the module from loading through other dependencies or auto-loading:

echo "install qla2xxx /bin/true" >> /etc/modprobe.d/blacklist-qla2xxx.conf

Caveat: Disabling this module prevents the system from using QLogic Fibre Channel adapters and attached storage. If the module is currently loaded into memory, a system restart is required for the configuration changes to take effect.