scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free. Unpublish ha->fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha->fce == NULL and skips it.
References
- https://git.kernel.org/stable/c/423487f03e325b8665d20a2a3171fe012b1a4fa9
- https://git.kernel.org/stable/c/7bd308cd893e8cce023d03a40a2f0adccaff0175
- https://git.kernel.org/stable/c/edc464a4fc96e2720d166e7cc7e7a6827b086760
- https://git.kernel.org/stable/c/6003e79148eca73d7cafb076f5be47e234d543d0
- https://git.kernel.org/stable/c/ef9b89f6c92274c3670403fd06130ca25f685050
- https://git.kernel.org/stable/c/8e7a26931b6111583cfeaf49c068f26524dc3af2
- https://git.kernel.org/stable/c/41ef7edde27ac87d55ffc703da44e78aa8c2e896
- https://git.kernel.org/stable/c/53298efcbbb0f0438366d45cb7ed7e6d93dd5531
European references
- ENISA EUVD · EUVD-2026-80453
- GCVE · GCVE-0-2026-89853
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 3a5a789494875376d1f8063ec5ecc6beafda2ce1 < 423487f03e325b8665d20a2a3171fe012b1a4fa9 ; affected 73d3d3c66f108bc47922490f8500842530139975 < 7bd308cd893e8cce023d03a40a2f0adccaff0175 ; affected 57c029cab0d908942e3ed9ff9fd0361144d01944 < edc464a4fc96e2720d166e7cc7e7a6827b086760 ; affected 217230bc8796a922d5b15a9a94ec4414b2d2b3e3 < 6003e79148eca73d7cafb076f5be47e234d543d0 ; affected 2cf3c3fe9a11aa168e80c966494c58548b9aed5d < ef9b89f6c92274c3670403fd06130ca25f685050 ; affected 841df27d619ee1f5ca6473e15227b39d6136562d < 8e7a26931b6111583cfeaf49c068f26524dc3af2 |
| Linux · Linux | affected 6.14 ; unaffected 0 < 6.14 ; unaffected 5.10.270 ≤ 5.10.* ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |