Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue list

Impact

The FC-NVMe abort paths called INIT_WORK() on priv->abort_work immediately before schedule_work(), which resets the work_struct list head and clears its pending bit. If a command is aborted twice - concurrent transport teardown plus a timeout-driven abort - the second INIT_WORK() reinitializes a work item that is still queued, corrupting the workqueue list and producing a crash or a looping worker. This is a race against error handling, so it surfaces exactly when the storage fabric is already unhappy: a node serving FC-NVMe-attached datasets panics or pins a CPU in a spinning worker during a storage event, and losing a GPU node mid-job is expensive. The fix moves the INIT_WORK() to command submission and leaves only schedule_work() in the abort paths.

Who can reach it

Not tenant-reachable. Needs FC-NVMe storage attached through a QLogic HBA and concurrent abort activity - typically a fabric fault, target reset or command timeout rather than a deliberate action. No authentication is involved.

What to do

Apply the linked stable commits or move to a patched distribution kernel and reboot each affected node. No configuration workaround exists; the only avoidance is not running FC-NVMe over qla2xxx.

References

Related entries

• KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tablesCVE-2026-89913 · Linux kernel KVM arm64 vgic-v3 (vgic_v3_save_pending_tables LPI iteration)High
• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High
• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High
• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High
• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh