Linux kernel qla2xxx: FC frame payload aliasing 0xDEADDEAD spins the interrupt handler into a CPU soft lockup

Impact

qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() busy-waited on rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide whether the next continuation IOCB had arrived. On a continuation IOCB that offset is not a signature field at all - it is raw FC frame payload. A received frame whose payload bytes happen to equal 0xDEADDEAD is read as "not yet arrived" and the loop spins on cpu_relax() forever in interrupt or DPC context, soft-locking a CPU. This is the most operationally interesting of the qla2xxx fixes in this batch because the trigger is frame content off the Fibre Channel fabric rather than a local privileged ioctl: anything that can put a frame on the fabric with the right four bytes can wedge a CPU on a storage-attached GPU node, and the node does not recover without a reboot.

Who can reach it

Reachable from the Fibre Channel fabric - any peer able to send the host a frame (unsolicited PT_LS4, NVMe purls, or FPIN path) whose payload aliases 0xDEADDEAD at the relevant offset. No host authentication involved; a benign frame can trigger it by accident, which is how most operators will meet this bug.

What to do

Run a kernel that removes the signature busy-wait from both helpers and gates the FPIN path on qla_chk_cont_iocb_avail(); four stable backports are linked in the record. Rollout is a drain and reboot per FC-attached node. There is no configuration mitigation - you cannot filter frame payload content - so until the kernel is updated the exposure is simply the fabric your HBAs sit on.

References

Related entries

• Linux qla2xxx: double free and NULL dma_pool use when adapter memory allocation fails at probeCVE-2026-97532 · Linux kernel scsi qla2xxx (qla2x00_mem_alloc error path, dangling pointers)Unscored
• Linux kernel qla2xxx: NPIV virtual-port index above 128 writes past the VP control IOCB bitmapCVE-2026-97535 · Linux kernel qla2xxx (VP_CTRL IOCB vp_idx_map bounds)Unscored
• Linux qla2xxx: NULL dma_free and mismatched bitmap locking in multiqueue queue teardownCVE-2026-97537 · Linux kernel scsi qla2xxx (multiqueue req/rsp queue teardown, qid bitmap locking)Unscored
• Linux kernel io_uring: MSG_TRUNC recv over-advances the provided buffer ringCVE-2026-97618 · Linux kernel io_uring/net (provided buffer ring accounting with MSG_TRUNC)Unscored
• Linux kernel io_uring: deferred write accounting deadlocks a task against filesystem freezeCVE-2026-97619 · Linux kernel io_uring/rw (superblock write accounting released from task_work)Unscored
• Linux kernel x86/mm: pmd_modify() drops the dirty bit, losing written data on PMD-mapped THPCVE-2026-97945 · Linux kernel x86/mm pmd_modify() (hardware dirty bit dropped on PMD-mapped THP)Unscored