From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 141AA48EC9D for ; Fri, 25 Sep 2026 10:24:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790331896; cv=none; b=bMNCKxM9cU3znNAfQDwKlnnaHxhfqktjmQGJTB/mRk3iKkKxtMsfkPs8bv2eQezZNNQ5EwnPs8IVIpj2tq1xIvHXGPlHSL3X3dW1q107zSEt/PdXUsqxJ7w78qnRUOBCUX7wBRTc07S1Nsb9QKgnET8H4l4Ko+5HslpR11ChZEs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790331896; c=relaxed/simple; bh=UmppbAR3ACdtCx/SCpbZQRPU6k8aoiATWzmYiw40DM4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ug3JJwCMVkeOycg9kqL2qlElwnYcCHSsFJZEUtZHH6F4NVQHoZXDcbpsERcfFskkFJTxuXprnyVEw6nVtJ9Y/MUCuvlwxJlyxKHI3ANHe4GAjX9HueZBfA1NWlfxe17xVkx+4+jXC9HPzX3ameUfH4aKuFH8njj71UV7xprrFd8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=djuQzEQU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="djuQzEQU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CFDF1F000FF; Fri, 25 Sep 2026 10:24:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790331895; bh=XxmHq0yqZKLHggIiO6iCBJPkDqGMkwrkoRK411dNW+M=; h=From:To:Cc:Subject:Date:Reply-To; b=djuQzEQUrcPJpZO1f2famTc0ZqJmh9SK5Q40n5dGaKmSCwCgLVIQ7uZEJLGrU/vsk HZ+tbbWl9P2onaMDGQt/gEjHdZef35xuARKISvBIZI3n2h2WV/6AFpLHSLm2Vphr+H 4AxHaQ1znzFDRO/SYAlhN8DuhY6PwnP8vqpqX5RY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock Date: Fri, 25 Sep 2026 12:21:47 +0200 Message-ID: <2026092546-CVE-2026-97527-bbb2@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2968; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=TW/CfTC+PjH3FAhAMU+L5T7FvrT9F9W+hF208BPawok=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvK0+JQlccOr6XW75Kia/S8Tm86STGU+7ngfb8DoUR B8oafPsiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlU9DHMU8hhuqL/wTFRp3nN jw+v07r+irPuZJhfVLpIgb9sovZh3QVvdj26vsHkXGMdAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers. Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free. The Linux kernel CVE team has assigned CVE-2026-97527 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 6.18.53 with commit b211d138cad86f749826d6132db6388eded992d8 Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 7.2.7 with commit 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0 Issue introduced in 6.6 with commit 875386b98857822b77ac7f95bdf367b70af5b78c and fixed in 7.3-rc1 with commit 76da0c43c63eb0496649e372ac64466364d0fe7d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97527 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/qla2xxx/qla_def.h drivers/scsi/qla2xxx/qla_init.c drivers/scsi/qla2xxx/qla_nvme.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b211d138cad86f749826d6132db6388eded992d8 https://git.kernel.org/stable/c/4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0 https://git.kernel.org/stable/c/76da0c43c63eb0496649e372ac64466364d0fe7d