UBUNTU-CVE-2026-89857: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb() allocates from and advances the request ring through qla2x00allociocbs() (which assumes the hardwarelock is held) and qla2x00startiocbs() (which advances the ring and rings the request-in doorbell), but takes no lock itself. Two of its callers invoke it without the producer lock held: - qlanvmexmtlsrsp(), the NVMe-FC .xmtlsrsp transport callback, on its error path, and - qla2xxxprocesspurlspkt(), run from the purex work/DPC context. Both use ha->baseqpair, whose qplockptr is hardwarelock, so they can run concurrently with normal I/O submission on the base ring and corrupt the ring producer state, leading to duplicated or dropped commands. The third caller, qla2xxxprocesspurlsiocb(), runs inside qla24xxprocessresponsequeue() with the qpair lock already held and is safe; that is also why the lock cannot be taken inside the helper itself (it would recursively re-acquire hardwarelock on the response path). Take qplockptr around the two unlocked callers and document the helper as caller-locked. Both run in process context, so spinlockirqsave() is used and nothing in the locked region sleeps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In qla_nvme_ls_reject_iocb() callers qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt(), acquire ha->base_qpair->qp_lock_ptr (hardware_lock) around the ring allocation/advancement operations; document qla_nvme_ls_reject_iocb() as requiring the caller to hold the qpair lock. Do not acquire the lock inside the helper because qla2xxx_process_purls_iocb() is already called with the qpair lock held from qla24xx_process_response_queue().