CVE-2026-97527

Received Received - Intake

Race Condition in QLogic qla2xxx NVMe Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers. Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97527

EUVD

EUVD-2026-86835

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel adapters. It involves a race condition where the unsol_ctx_head list in the fcport structure is modified from multiple contexts without proper synchronization. The list is updated in different functions running in interrupt service routines, worker threads, and callbacks, leading to potential corruption of list pointers due to concurrent add and delete operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx SCSI driver and involves race conditions in the NVMe unsolicited context list handling. Detection requires checking kernel logs for related errors or kernel crashes involving the qla2xxx module. Commands like dmesg | grep qla2xxx or journalctl -k | grep qla2xxx may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could cause system instability or crashes due to corrupted list pointers in the kernel. It may lead to kernel panics, data corruption, or denial of service if exploited. Systems using affected QLogic Fibre Channel adapters with NVMe over Fabrics (NVMe-FC) could experience these issues.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel SCSI driver issue involving race conditions in NVMe unsolicited context list handling, which could lead to memory corruption or crashes. Compliance impacts would only occur if exploitation caused data breaches or system failures affecting regulated data.

Mitigation Strategies

Immediately update the Linux kernel to a version that includes the fix for CVE-2026-97527. If updating is not immediately possible, consider disabling the qla2xxx driver if not in use. Monitor system logs for signs of exploitation or instability related to the qla2xxx module.

Hi! I’m here to help you understand CVE-2026-97527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70