CVE-2026-97528: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
qlanvmexmtlsrsp() obtains uctx, which was linked into fcport->unsolctxhead by qla2xxxprocesspurlsiocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() but never removes it from the list. This leaves a freed node in fcport->unsolctxhead: the next listaddtail() for that fcport writes through the freed node, and a subsequent listdel() can corrupt the list or panic.
Unlink uctx with listdel() before kfree() on the error path, matching the other free sites in qlanvmereleaselsrspcmdkref() and qla2xxxprocesspurlspkt(). qla2x00relsp() in the failure path only returns the SRB to its pool and does not invoke sp->putfn, so the out: path is the sole free and uctx is always still linked there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel qla2xxx driver with NVMe unsolicited context handling are exposed when the affected LS-response error path is reached for an fcport. The issue concerns a context that remains linked in fcport->unsol_ctx_head after being freed.
What conditions are needed to trigger the failure?
An LS response transmission must take the error path in qla_nvme_xmt_ls_rsp() after qla2xxx_process_purls_iocb() has linked the unsolicited context into fcport->unsol_ctx_head. Later list operations for the same fcport can then write through the freed node or corrupt the list.
What is the likely impact after the error path is hit?
A subsequent list_add_tail() for the affected fcport can access the freed list node, and a later list_del() can corrupt the list or cause a kernel panic.
How can this be mitigated if the fix cannot be applied immediately?
The provided data identifies the triggering condition as an LS-response transmission error path, but does not provide a supported configuration workaround. Applying a kernel version containing the fix is the documented remediation.