CVE-2026-97527

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

The fcport->unsol_ctx_head list is modified from several contexts without

a common lock. Entries are added in qla2xxx_process_purls_iocb() from the

response queue ISR (under the qpair qp_lock), while they are removed from

qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp()

(NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB

completion). The qpair qp_lock cannot serialize this per-fcport list since

multiqueue adapters add entries through different qpairs, so a concurrent

add and delete (or two concurrent deletes) can corrupt the list pointers.

Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in

qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del()

on unsol_ctx_head. The add nests under the existing qp_lock; no delete path

takes qp_lock, so the lock order is consistent a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References