CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

The fcport->unsol_ctx_head list is modified from several contexts without
a common lock. Entries are added in qla2xxx_process_purls_iocb() from the
response queue ISR (under the qpair qp_lock), while they are removed from
qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp()
(NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB
completion). The qpair qp_lock cannot serialize this per-fcport list since
multiqueue adapters add entries through different qpairs, so a concurrent
add and delete (or two concurrent deletes) can corrupt the list pointers.

Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in
qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del()
on unsol_ctx_head. The add nests under the existing qp_lock; no delete path
takes qp_lock, so the lock order is consistent and deadlock free.

The Linux kernel CVE team has assigned CVE-2026-97527 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 6.18.53 with commit b211d138cad86f749826d6132db6388eded992d8
	Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 7.2.7 with commit 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0
	Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 7.3-rc1 with commit 76da0c43c63eb0496649e372ac64466364d0fe7d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97527
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/qla2xxx/qla_def.h
	drivers/scsi/qla2xxx/qla_init.c
	drivers/scsi/qla2xxx/qla_nvme.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b211d138cad86f749826d6132db6388eded992d8
	https://git.kernel.org/stable/c/4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0
	https://git.kernel.org/stable/c/76da0c43c63eb0496649e372ac64466364d0fe7d