CVE-2026-97530

Received Received - Intake

Soft lockup in Linux kernel QLA2xxx SCSI driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide whether the next continuation IOCB has arrived, spinning on cpu_relax() without advancing the ring or decrementing the entry count while it has not. response_t::signature lives at byte offset 60, but a continuation IOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame payload at that offset (data[56..59]). A received frame whose payload bytes happen to equal 0xDEADDEAD is therefore misread as "not yet arrived", and the loop spins forever in interrupt/DPC context, causing a CPU soft lockup. The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt() (PT_LS4_UNSOL and the NVMe purls path) already gate on qla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are present before copying begins. The sibling helper __qla_copy_purex_to_buffer() already drops the signature poll and relies on the entry_type == STATUS_CONT_TYPE guard instead. Remove the signature busy-wait from both helpers, keeping the entry_type guard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers and re-processes on the next interrupt once all continuation IOCBs have arrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the signature field is never read on a continuation IOCB, eliminating the payload-aliasing lockup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97530

EUVD

EUVD-2026-86838

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a soft lockup vulnerability in the Linux kernel's SCSI driver for QLogic QLA2xxx adapters. It occurs when the system misinterprets data in a received frame as a continuation IOCB signature, causing an infinite loop in interrupt context. The issue stems from polling a signature field that overlaps with raw frame payload data, leading to a CPU hang.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx driver and may cause CPU soft lockups. Detection involves checking kernel logs for soft lockup messages or system hangs related to the SCSI subsystem. Monitor logs with 'dmesg | grep -i lockup' or 'journalctl -k | grep -i lockup'. If the system is unresponsive, a hard reboot may be required.

Impact Analysis

This vulnerability can cause system instability by triggering CPU soft lockups. Affected systems may become unresponsive, requiring a reboot to recover. It primarily impacts systems using QLogic QLA2xxx SCSI adapters with specific firmware versions.

Compliance Impact

This vulnerability causes a CPU soft lockup due to an infinite loop in interrupt context, which could lead to system unresponsiveness or crashes. Such instability may impact the availability of systems handling sensitive data, potentially violating compliance requirements for uptime and reliability in standards like GDPR (data availability) and HIPAA (system integrity).

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that includes the fix for CVE-2026-97530. Check your distribution's security advisories for kernel updates. If updating is not immediately possible, consider disabling the qla2xxx driver if not in use, but this may impact storage functionality.

Hi! I’m here to help you understand CVE-2026-97530. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70