All vulnerabilities
CVE-2026-97527

Linux: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6c71726cdfda93ae169a75c7b1697eb870303125Also 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0, 76da0c43c63eb0496649e372ac64466364d0fe7dCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6c71726cdfda93ae169a75c7b1697eb870303125LinuxCVE List
  • 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0LinuxCVE List
  • 76da0c43c63eb0496649e372ac64466364d0fe7dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers.

Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free.

Text from CVE List

Affected versions 12

  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before 6c71726cdfda93ae169a75c7b1697eb870303125CVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before c1ee12eecbab9674fb73c9e00a93fac655d5a5dcCVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before b211d138cad86f749826d6132db6388eded992d8CVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0CVE List
  • Linuxaffected: 875386b98857822b77ac7f95bdf367b70af5b78c before 76da0c43c63eb0496649e372ac64466364d0fe7dCVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5