Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the list

Impact

On the error path of qla_nvme_xmt_ls_rsp(), the qla2xxx driver frees the unsolicited-context object with kfree() without first unlinking it from fcport->unsol_ctx_head, where qla2xxx_process_purls_iocb() put it. The list then holds a freed node: the next list_add_tail() for that fcport writes through freed memory and a later list_del() can corrupt the list or panic. The fix adds the missing list_del() before the free, matching the other free sites. Impact on a storage-attached node is use-after-free memory corruption and a likely panic while FC-NVMe LS responses are failing, taking the node out along with its storage path. Kept separate from the locking bug in the same file (CVE-2026-97527) because the mechanism and the fix differ - one is a missing lock across contexts, this is a missing unlink on one error path - and a node may carry one fix without the other. Nodes without qla2xxx FC HBAs or without FC-NVMe are unaffected.

Who can reach it

Requires the qla2xxx driver with FC-NVMe in use and an LS-reject/error condition on unsolicited LS handling, driven by Fibre Channel fabric traffic. No host login and no tenant-side access reaches this; an unprivileged local user cannot trigger it.

What to do

Move to a stable kernel containing the linked commits and reboot each affected node. As with the sibling qla2xxx fix, a module reload is not realistic where root or dataset storage sits behind the HBA, so budget a drain and reboot per FC-attached node and pick both qla2xxx fixes up in the same window. No configuration-only mitigation.

References

Related entries

• Linux KVM x86: per-vCPU MMIO cache uses address space 0, letting a guest force bogus MMIO exitsCVE-2026-99082 · Linux kernel KVM x86 (per-vCPU MMIO cache, SMM address space)High
• Erlang/OTP public_key: unbounded certificate policy tree lets a TLS peer exhaust the BEAM nodeCVE-2026-59251 · Erlang/OTP public_key pubkey_policy_tree (X.509 certificate policy validation)High
• libssh2: malicious SSH server can corrupt the heap of any client opening an SFTP sessionCVE-2026-66032 · libssh2 sftp_open() (src/sftp.c double free)High
• libssh2: pre-auth integer underflow crashes any client that negotiates AES-GCMCVE-2026-66033 · libssh2 ssh2_cipher_crypt() (src/openssl.c AES-GCM length underflow)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High