7.5

CVE-2026-97531: linux

CVSS: 7.5v3.1HighReceived
AliasesUBUNTU-CVE-2026-97531DEBIAN-CVE-2026-97531
Published 25-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-97531 is a high (CVSS 7.5) vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.28%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12074-1

Timeline

  1. 25-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

26-09-202621-10-2026
EPSS score
0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.113-1 | < 7.2.7-1
Linux1 product
  • linux≥ 41dc529a4602ac737020f423f84686a81de38e6d, < 40dcd4a71a52414b47fbba2f956387f1077c6c15 | ≥ 41dc529a4602ac737020f423f84686a81de38e6d, < 20bb54601d2655e83795b73499c89f6b1cb31016 | ≥ 41dc529a4602ac737020f423f84686a81de38e6d, < d61e8de98c5a52978fb1edd95fe4dde3131b280e | ≥ 41dc529a4602ac737020f423f84686a81de38e6d, < 7a83979d92782f83c90888ebe19bdc9420521940 | ≥ 41dc529a4602ac737020f423f84686a81de38e6d, < 23582731afa35031c94fadb71a4f3b4afd094649 | 4.11

3 vendors · 170 products

References

8 links