Linux kernel qla2xxx: NVMe LS reject path advances the request ring without the qpair lock

Impact

qla_nvme_ls_reject_iocb() allocates from and advances the hardware request ring, but two callers - the NVMe-FC .xmt_ls_rsp error path and the purex work context - invoked it with no lock held. Both use the base qpair whose lock is hardware_lock, so they can run alongside normal I/O submission and corrupt the ring producer state, duplicating or dropping SCSI/NVMe commands. On a storage-attached node that is silent data-path damage rather than a clean crash, which is the worse failure mode for a shared filesystem backing training checkpoints. Only nodes with QLogic FC HBAs doing NVMe-over-FC are in scope.

Who can reach it

Local and hardware-dependent: needs a QLogic HBA running NVMe-over-FC, with an LS reject on the error or purex path racing normal submission. Not tenant-reachable as described.

What to do

Update to a kernel where both callers take qp_lock_ptr around the helper, and reboot the affected FC-attached nodes. Nodes without qla2xxx NVMe-FC are unaffected. The record gives stable commits only.

References

Related entries

• Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive bufferCVE-2026-89969 · Linux kernel nvmet-tcp (NVMe-over-TCP target PDU receive)Critical
• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical
• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical
• Linux kernel CephFS client: use-after-free when an MDS session reopens during an access checkCVE-2026-89990 · Linux kernel CephFS client (ceph_mds_check_access)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps a blocked lockCVE-2026-90036 · Linux kernel NFSD (blocked-lock laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps close_lru open ownersCVE-2026-90037 · Linux kernel NFSD (close_lru laundromat reaping)Critical