{"id":"CVE-2026-97532","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path\n\nWhen qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to\nprobe_hw_failed and calls qla2x00…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path\n\nWhen qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to\nprobe_hw_failed and calls qla2x00…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1341"],"vendor":"Linux","product":"Linux","affected":["Linux >= d64d6c5671db5e693a0caaee79f2571b098749c9 < 84f5de696b8c924aeb4bf430a0bdc762fc50e99f","Linux >= d64d6c5671db5e693a0caaee79f2571b098749c9 < a57570229edb7a0990d5c8067daeb9ac8858a961","Linux >= d64d6c5671db5e693a0caaee79f2571b098749c9 < 286d9594a022dd7e0caa3de9daa63b896bc70d43","Linux >= d64d6c5671db5e693a0caaee79f2571b098749c9 < 6d90f0feb929f6c0f3010f9af4747c7230b75993","Linux 8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc","Linux 7142b10b87d5b393a0688358b16a4b1d3680ec7d","Linux >= 4.14.27 < 4.15","Linux >= 4.15.10 < 4.16","Linux 4.16"],"published":"2026-09-25","updated":"2026-10-03","sourceUpdated":"2026-10-03T11:18:02.077","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97532","references":[{"url":"https://git.kernel.org/stable/c/286d9594a022dd7e0caa3de9daa63b896bc70d43","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d90f0feb929f6c0f3010f9af4747c7230b75993","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84f5de696b8c924aeb4bf430a0bdc762fc50e99f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a57570229edb7a0990d5c8067daeb9ac8858a961","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97532.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97532"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541087"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97532"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97532"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97532.mbox"},{"url":"https://git.kernel.org/stable/c/5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00206,"epssPercentile":0.10589,"cvssSource":"vendor","ingestedAt":"2026-09-25T11:06:38.925Z","slug":"CVE-2026-97532","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path\n\nWhen qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to\nprobe_hw_failed and calls qla2x00_mem_free(). Several error labels in\nqla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool,\nflt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info)\nbut left the pointers dangling. qla2x00_mem_free() then freed them a\nsecond time. Worse, for the dma_pool members it issued\ndma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been\ndestroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.\n\nClear each freed pointer (and its DMA handle) in the error labels so the\nsubsequent qla2x00_mem_free() skips them.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97532.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":212494,"id":"CVE-2026-97532","ts":1790668190690,"field":"cvss","old":null,"new":"7"},{"seq":212493,"id":"CVE-2026-97532","ts":1790668190690,"field":"severity","old":"none","new":"high"}]}