CVE-2026-97532: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-97532DEBIAN-CVE-2026-97532
Published 25-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-97532 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.20%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12074-1

Timeline

  1. 25-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool. Clear each freed pointer (and its DMA handle) in the error labels so the subsequent qla2x00_mem_free() skips them.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

26-09-202621-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.113-1 | < 7.2.7-1
Linux1 product
  • linux≥ d64d6c5671db5e693a0caaee79f2571b098749c9, < 5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84 | ≥ d64d6c5671db5e693a0caaee79f2571b098749c9, < 84f5de696b8c924aeb4bf430a0bdc762fc50e99f | ≥ d64d6c5671db5e693a0caaee79f2571b098749c9, < a57570229edb7a0990d5c8067daeb9ac8858a961 | ≥ d64d6c5671db5e693a0caaee79f2571b098749c9, < 286d9594a022dd7e0caa3de9daa63b896bc70d43 | ≥ d64d6c5671db5e693a0caaee79f2571b098749c9, < 6d90f0feb929f6c0f3010f9af4747c7230b75993 | 8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc | 7142b10b87d5b393a0688358b16a4b1d3680ec7d | ≥ 4.14.27, < 4.15 | ≥ 4.15.10, < 4.16 | 4.16

3 vendors · 171 products

References

8 links