Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and delete

Impact

The per-fcport unsol_ctx_head list in the QLogic qla2xxx Fibre Channel driver is modified from four contexts with no common lock: entries are added from the response-queue ISR under the qpair qp_lock, and removed from the DPC/purex worker, the NVMe-FC transport callback and SRB completion. On a multiqueue HBA the adds arrive through different qpairs, so qp_lock cannot serialize the list and a concurrent add and delete - or two deletes - corrupts the list pointers. The fix adds a dedicated per-fcport unsol_ctx_lock around every list_add_tail()/list_del(). The practical consequence on a storage node is list corruption leading to a kernel panic or worse under FC-NVMe traffic, which takes the node and its attached storage path down; GPU nodes that boot from or stage datasets over FC-NVMe lose the array with it. Triggering depends on FC fabric traffic timing rather than on anything a tenant process controls - NVD's AV:A adjacent score reflects the fabric, not a tenant pod. Nodes without qla2xxx FC HBAs or without FC-NVMe are unaffected.

Who can reach it

Requires a system running the qla2xxx driver with FC-NVMe in use; the race is driven by unsolicited LS traffic arriving from the Fibre Channel fabric, so it needs presence on that fabric rather than any login to the host. Not reachable by an unprivileged local user or a tenant GPU pod.

What to do

Update to a stable kernel carrying the linked commits and reboot each affected node. A qla2xxx module reload is theoretically narrower but not practical on a node whose root or dataset storage is behind the HBA, so in the field this is drain-and-reboot per storage-attached node. There is no configuration mitigation short of not using FC-NVMe on that path.

References

Related entries

• Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the listCVE-2026-97528 · Linux kernel scsi qla2xxx (uctx freed without list_del() on qla_nvme_xmt_ls_rsp() error path)High
• Linux KVM x86: per-vCPU MMIO cache uses address space 0, letting a guest force bogus MMIO exitsCVE-2026-99082 · Linux kernel KVM x86 (per-vCPU MMIO cache, SMM address space)High
• Erlang/OTP public_key: unbounded certificate policy tree lets a TLS peer exhaust the BEAM nodeCVE-2026-59251 · Erlang/OTP public_key pubkey_policy_tree (X.509 certificate policy validation)High
• libssh2: malicious SSH server can corrupt the heap of any client opening an SFTP sessionCVE-2026-66032 · libssh2 sftp_open() (src/sftp.c double free)High
• libssh2: pre-auth integer underflow crashes any client that negotiates AES-GCMCVE-2026-66033 · libssh2 ssh2_cipher_crypt() (src/openssl.c AES-GCM length underflow)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh