CVE-2026-97531

A flaw was found in the Linux kernel's qla2xxx Fibre Channel driver. This issue may allow a local privileged user or storage fabric event to cause a Denial of Service (DoS) through a system crash. A race condition occurs when a virtual port is deleted concurrently with a port identification request, causing the driver to mistakenly re-insert the terminating port into its internal host tracking map. Once the port resources are freed, subsequent lookups dereference deallocated memory, triggering a use-after-free condition.

A race in the qla2xxx driver can reinsert a vport into host_map after the vport deletion path has removed it and cleared its port identifier. The vport can later be freed by scsi_host_put while the stale host_map entry remains reachable, so a later host_map lookup may dereference freed memory. For the CVSS the PR:L value in the paranoid score applies where a tenant, service account, or delegated container workload can control the lifecycle of an assigned FC NPIV virtual port. The base case uses PR:H because vport deletion and FC adapter management normally require administrative privileges. The race requires precise timing and is not directly reachable through ordinary IP packet traffic. Impact is at least local denial of service through a kernel crash and in the worst case may allow limited confidentiality or integrity impact due to the use after free condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.