Linux kernel qla2xxx: wrong free of a pooled purex item on the PURLS error path corrupts memory

Impact

qla2xxx_process_purls_iocb() allocates a purex item through qla27xx_copy_multiple_pkt(), which may hand back a pre-allocated entry from the per-adapter pool rather than a kzalloc'd one. Its error path calls kfree() unconditionally, so a pooled item gets freed to the slab allocator - kernel memory corruption. The trigger is an unsolicited PURLS frame from the Fibre Channel fabric that hits the error path, meaning the input comes from the SAN rather than from a tenant. Nodes using QLogic FC HBAs for shared storage are affected; the realistic outcome is a corrupted-slab panic on a storage-attached node, which stalls every job whose dataset lives behind that HBA.

Who can reach it

Something on the Fibre Channel fabric that can send the node unsolicited PURLS frames - another host, a switch, or a misbehaving array. Not reachable from a tenant GPU pod, and no host credentials are needed. Only nodes with qla2xxx HBAs in a configuration that processes PURLS are exposed.

What to do

Apply the stable-kernel fix (commits below), which routes the error path through qla24xx_free_purex_item(). Driver code, so a reboot after the kernel update is the clean route; unloading and reloading qla2xxx means losing the storage paths under it, which on a node holding mounted FC LUNs is effectively a drain anyway. Schedule per-node drain and reboot. No vendor-stated workaround.

References

Related entries

• Linux kernel qla2xxx: commands leak after chip reset, and racing unmaps hit a BUG_ONCVE-2025-68745 · Linux kernel qla2xxx (command cleanup after chip reset)Critical
• Linux kernel iomap: length underflow on non-block-aligned reads returns a position past the folioCVE-2025-68794 · Linux kernel iomap (iomap_adjust_read_range block alignment)Critical
• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket'sCVE-2026-23450 · Linux kernel (net/smc)Critical
• Linux kernel idxd: wrong descriptor completed in llist_abort_desc() abort pathCVE-2026-31436 · Linux kernel dmaengine idxd (llist_abort_desc descriptor completion)Critical
• Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical