Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers. Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T11:17:02.873Z",
  "pubdate": "2026-09-25T11:17:02.873Z",
  "executiveSummary": "The Linux kernel qla2xxx driver contains a race condition vulnerability within the management of the fcport->unsol_ctx_head list, which handles NVMe unsolicitated context entries.\nThe vulnerability arises from insufficient synchronization when modifying this list across multiple concurrent execution contexts, including interrupt service routines and various worker threads.\nAn attacker capable of triggering specific NVMe-FC transport operations could potentially cause memory corruption due to improper list pointer manipulation.\nThe impact includes system instability, potential kernel panics, or unpredictable behavior in the SCSI/NVMe subsystem of the QLogic adapter.\nThis issue is classified as a concurrency-related race condition. Successful exploitation relies on the ability to trigger high-frequency asynchronous operations that lead to simultaneous list modifications.\nThe risk is localized to the kernel memory management of the affected driver, requiring local system access or specific fabric interactions to reach the vulnerable code paths.",
  "technicalDetails": "The root cause of this vulnerability is a lack of serialization in the qla2xxx driver when accessing the fcport->unsol_ctx_head linked list. The driver allows modifications to this list from multiple disparate contexts without the protection of a common synchronization primitive.\nEntries are added to the list via qla2xxx_process_purls_iocb(), which executes within the response queue Interrupt Service Routine (ISR) under the protection of a qpair qp_lock. Conversely, entries are removed by functions such as qla2xxx_process_purls_pkt(), qla_nvme_xmt_ls_rsp(), and qla_nvme_release_lsrsp_cmd_kref(), which operate in DPC/purex worker threads or NVMe-FC transport callback contexts.\nThe qp_lock is insufficient for total serialization because multiqueue adapters process entries through various qpairs. Consequently, concurrent list operations—specifically simultaneous list additions or deletions—lead to a race condition that compromises the integrity of the list pointers.\nExploitation occurs when a sequence of events triggers concurrent modifications to the list. An attacker could flood the system with specific NVMe management operations, increasing the probability of a collision between the insertion and removal functions.\nWhen two concurrent threads modify the list pointers (e.g., list_add_tail and list_del), the internal state of the linked list can become corrupted, pointing to invalid memory locations or creating circular references.\nPost-exploitation, a corrupted list header can trigger a kernel oops or a system-wide crash during subsequent list traversals or further management operations. Since the kernel is responsible for managing these lists, the resulting memory corruption may be leveraged to destabilize the storage subsystem or cause a Denial of Service (DoS)."
}