SB20260928408 - Race condition in Linux kernel scsi qla2xxx driver

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-97537)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite a request or response queue map entry.

The vulnerability exists due to a race condition in qla25xx_free_req_que() and qla25xx_free_rsp_que() when queue creation fails concurrently with another queue allocation. A local user can race queue creation and teardown to overwrite a request or response queue map entry.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873
• https://git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e
• https://git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22