{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97528 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97528 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97528 and fix it if it is affected.\n\nWhat it is: CVE-2026-97528 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97528 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97528/ (Markdown: https://insights.sbomify.com/CVE-2026-97528/index.md)","id":"CVE-2026-97528","markdown":"https://insights.sbomify.com/CVE-2026-97528/index.md","name":"CVE-2026-97528","record":{"aliases":["AZL-104436","BELL-CVE-2026-97528","DEBIAN-CVE-2026-97528","GHSA-cw7x-747c-3cx3","UBUNTU-CVE-2026-97528"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A use-after-free in the qla2xxx NVMe driver allows attackers to cause a kernel panic or list corruption via specific link service reject errors.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport-\u003eunsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport-\u003eunsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp-\u003eput_fn, so the out:\npath is the sole free and uctx is always still linked there.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error","id":"CVE-2026-97528","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]","id":"CVE-2026-97529"},"packages":[],"prev":{"headline":"scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock","id":"CVE-2026-97527"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free in the qla2xxx NVMe driver allows attackers to cause a kernel panic or list corruption via specific link service reject errors.","url":"https://insights.sbomify.com/CVE-2026-97528/"}