8.8

CVE-2026-97528: linux

CVSS: 8.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-97528DEBIAN-CVE-2026-97528
Published 25-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-97528 is a high (CVSS 8.8) vulnerability in linux. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.32%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12074-1

Timeline

  1. 25-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsol_ctx_head: the next list_add_tail() for that fcport writes through the freed node, and a subsequent list_del() can corrupt the list or panic. Unlink uctx with list_del() before kfree() on the error path, matching the other free sites in qla_nvme_release_lsrsp_cmd_kref() and qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only returns the SRB to its pool and does not invoke sp->put_fn, so the out: path is the sole free and uctx is always still linked there.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

26-09-202621-10-2026
EPSS score
0.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.113-1 | < 7.2.7-1
Linux1 product
  • linux≥ 875386b98857822b77ac7f95bdf367b70af5b78c, < 925a9129a514b7c3bc0a8af01e51868adbb9a83e | ≥ 875386b98857822b77ac7f95bdf367b70af5b78c, < cbbf1484496aac86038e67ac984949af58009d4b | ≥ 875386b98857822b77ac7f95bdf367b70af5b78c, < a95fc5f1c12bba1dbff72bd2611e7fad0758831b | ≥ 875386b98857822b77ac7f95bdf367b70af5b78c, < c55d649a6cc246c3ccd5d118faea230c46b60f35 | ≥ 875386b98857822b77ac7f95bdf367b70af5b78c, < e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd | 6.6

3 vendors · 144 products

References

8 links