Linux qla2xxx: abort-all path calls sp->done() without checking cmd_type, crashing in target mode

Impact

__qla2x00_abort_all_cmds assumed every command was TYPE_SRB and called sp->done() on it; with a TYPE_TGT_CMD command the jump lands on a NULL pointer and the host oopses during ISP error recovery. The upstream report includes the exact oops from a Supermicro X11SPL-F server, so this is a real, observed kernel crash, not a theoretical one. It matters only to hosts running the QLogic FC driver in target mode - a Linux box exporting LUNs over Fibre Channel to the fleet - where the crash takes the storage target down and, with it, every client depending on it. The fix is a revert plus removal of now-redundant code; the switch below it already handled the chip-down case correctly.

Who can reach it

No attacker path is established in the record. The crash is triggered by an ISP system error / error-recovery event on the FC HBA while target-mode commands are outstanding; it needs no credentials because it needs no user at all. Initiator-only hosts do not reach the affected code path.

What to do

Update to a stable kernel containing the revert (five stable branches carry it - see the git.kernel.org commits) and reboot the affected FC target hosts. No fixed release tag is given upstream, so pick the backport matching your branch. If you run qla2xxx initiator-only, no action is needed; if you run a Linux FC target, schedule the reboot with the LUNs failed over, since the bug surfaces precisely when the HBA is already in trouble.

References

Related entries

• Linux kernel (drivers/iommu): This is the substantive fix for stale IOMMU translations of the kernel address spaceCVE-2025-71202 · Linux kernel (drivers/iommu)High
• KubeVirt virt-handler (symlink following in migration proxy): During live migration virt-handler dials Unix socketsCVE-2026-13622 · KubeVirt virt-handler (symlink following in migration proxy)High
• SSSD LDAP sudo provider: unscoped sudoRole search lets any LDAP writer grant themselves root fleet-wideCVE-2026-14474 · SSSD LDAP sudo provider (ldap_sudo_search_base unset)High
• Linux kernel (arch/x86/kvm): An emulated MMIO write that straddles a page boundary onto a second MMIO page is splitCVE-2026-31588 · Linux kernel (arch/x86/kvm)High
• Linux kernel (drivers/iommu/generic_pt): When an unmap lands in the middle of a large or contiguous page-table entryCVE-2026-31735 · Linux kernel (drivers/iommu/generic_pt)High
• OpenSSL: use-after-free in PKCS7_verify when a signed message carries an empty digestAlgorithms setCVE-2026-45447 · OpenSSL PKCS7_verify (empty digestAlgorithms SET)High