CVE-2026-93242

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

qla24xx_process_response_queue() advances ring_ptr past the head IOCB

before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr

already points at the first continuation IOCB. The function however

looped purex->entry_count times starting at ring_ptr. As entry_count

includes the head, this consumed one entry too many: it stamped

RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring

past it, silently dropping a legitimate firmware response. The head

IOCB's signature was also never marked.

Mark the head processed and account for it, then consume only the

entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References