CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
The fcport->unsolctxhead list is modified from several contexts without a common lock. Entries are added in qla2xxxprocesspurlsiocb() from the response queue ISR (under the qpair qplock), while they are removed from qla2xxxprocesspurlspkt() (DPC/purex worker), qlanvmexmtlsrsp() (NVMe-FC transport callback) and qlanvmereleaselsrspcmdkref() (SRB completion). The qpair qplock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers.
Introduce a dedicated per-fcport spinlock, unsolctxlock, initialized in qla2x00allocfcport(), and take it around every listaddtail()/listdel() on unsolctxhead. The add nests under the existing qplock; no delete path takes qplock, so the lock order is consistent and deadlock free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel qla2xxx SCSI driver with NVMe-FC unsolicited context processing are exposed. The race is specifically relevant to multiqueue adapters, where different queue pairs can concurrently add entries for the same FC port.
What conditions are required to trigger the issue?
Concurrent access to an FC port's unsol_ctx_head list is required. Entries must be added from the response-queue interrupt context while one or more removal paths run from the DPC/purex worker, NVMe-FC transport callback, or SRB completion context.
What can happen if the issue is triggered?
Concurrent additions and removals, or simultaneous removals, can corrupt the list pointers in the per-FC-port unsolicited-context list.
What mitigation is described if an updated kernel is not immediately available?
The provided data does not describe an operational workaround. The fix adds a dedicated per-FC-port spinlock around every addition to and deletion from the affected list.