In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
In the format 1 path, the virtual port is located on ha->vp_list while
holding vport_slock, but the lock is dropped before vp is used:
qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/
REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that
window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport
down and free it, leading to a use-after-free.
Take a vport reference (vref_count) under vport_slock when the matching
vp is found, and drop it after the last use of
vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before
unlinking and freeing the vport, so the pointer stays valid. This
matches the reference idiom already used by the other ha->vp_list
traversals.
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1
AV:N - qla24xx_report_id_acquisition() runs from qla24xx_process_response_queue() and the ATIO MSI-X path on firmware VP_RPT_ID IOCBs after fabric FDISC or VP_STAT_ID_CHG. QLogic CNAs speak FCoE and SANs are stretched via FCIP, so a remote SAN peer drives this without a local syscall, matching sibling CVE-2026-89848.
AC:H - The use-after-free requires qla24xx_deallocate_vp_id() to unlink the vport and scsi_host_put() it after the ISR drops vport_slock, which occurs only during NPIV vport deletion or failed vport create, a victim state a fabric attacker cannot initiate.
PR:N - Report-ID IOCBs are firmware completions of unauthenticated Fibre Channel fabric login and N_Port ID assignment. The interrupt path performs no Linux credential or capability check, so a fabric peer needs no account on the victim host.
UI:N - VP_RPT_ID handling runs automatically from the HBA interrupt and qla_do_work paths when the fabric assigns or changes an NPIV port ID. Concurrent vport teardown occurs during routine NPIV delete or driver remove, without a mount, open, or other interactive victim step.
S:U - The use-after-free is of scsi_qla_host inside the host kernel qla2xxx driver and does not cross a VM, IOMMU, or other separate security-authority boundary.
C:H - After scsi_host_put() frees the vport, the ISR still calls qla_update_host_map() and set_bit() on the dangling scsi_qla_host. That kernel heap use-after-free enables disclosure of reused object contents.
I:H - qla_update_host_map() writes the freed vport's d_id and inserts the dangling vha pointer into ha->host_map, and set_bit() writes vp_flags/dpc_flags on the freed object, yielding a kernel write and control-flow hijack primitive.
A:H - Use-after-free of scsi_qla_host from interrupt or qla_do_work context produces a kernel oops or panic even when not fully exploited, taking down storage served by the adapter.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
High |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - qla24xx_report_id_acquisition() runs from qla24xx_process_response_queue() and the ATIO MSI-X path on firmware VP_RPT_ID IOCBs after fabric FDISC or VP_STAT_ID_CHG. QLogic CNAs speak FCoE and SANs are stretched via FCIP, so a remote SAN peer drives this without a local syscall, matching sibling CVE-2026-89848.
AC:H - The use-after-free requires qla24xx_deallocate_vp_id() to unlink the vport and scsi_host_put() it after the ISR drops vport_slock, which occurs only during NPIV vport deletion or failed vport create, a victim state a fabric attacker cannot initiate.
PR:N - Report-ID IOCBs are firmware completions of unauthenticated Fibre Channel fabric login and N_Port ID assignment. The interrupt path performs no Linux credential or capability check, so a fabric peer needs no account on the victim host.
UI:N - VP_RPT_ID handling runs automatically from the HBA interrupt and qla_do_work paths when the fabric assigns or changes an NPIV port ID. Concurrent vport teardown occurs during routine NPIV delete or driver remove, without a mount, open, or other interactive victim step.
S:U - The use-after-free is of scsi_qla_host inside the host kernel qla2xxx driver and does not cross a VM, IOMMU, or other separate security-authority boundary.
C:H - After scsi_host_put() frees the vport, the ISR still calls qla_update_host_map() and set_bit() on the dangling scsi_qla_host. That kernel heap use-after-free enables disclosure of reused object contents.
I:H - qla_update_host_map() writes the freed vport's d_id and inserts the dangling vha pointer into ha->host_map, and set_bit() writes vp_flags/dpc_flags on the freed object, yielding a kernel write and control-flow hijack primitive.
A:H - Use-after-free of scsi_qla_host from interrupt or qla_do_work context produces a kernel oops or panic even when not fully exploited, taking down storage served by the adapter.
CVSS 3.1