CVE-2026-93242: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb()
qla24xxprocessresponsequeue() advances ringptr past the head IOCB before dispatching, so by the time qlaconsumeiocb() runs, ringptr already points at the first continuation IOCB. The function however looped purex->entrycount times starting at ringptr. As entrycount includes the head, this consumed one entry too many: it stamped RESPONSEPROCESSED on the next, unrelated IOCB and advanced the ring past it, silently dropping a legitimate firmware response. The head IOCB's signature was also never marked.
Mark the head processed and account for it, then consume only the entrycount - 1 continuation IOCBs, matching qlacopypurextobuffer().
Affected Software
Event History
Frequently Asked Questions
What operational impact can this defect cause?
The driver can silently drop a legitimate firmware response by marking the next unrelated IOCB as processed and advancing past it. The head IOCB is also left without its processed signature.
What does the fix change in response queue handling?
It marks the head IOCB as processed and consumes only the continuation IOCBs, using entry_count minus one. This aligns consumption with the existing copy-to-buffer behavior.
How can maintainers check whether their kernel source contains the fix?
Compare the kernel source history with the listed stable commit references: a136c311676fd1010b1bde3bcfd410caa2fa040f, d841707fafba5f80341b82e8c3a4c24fc5aa5132, and 6e3f129538c32d0019437197735912308c161843. No affected or fixed kernel release versions are provided.