CVE-2026-97530

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature

qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll

rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide

whether the next continuation IOCB has arrived, spinning on cpu_relax()

without advancing the ring or decrementing the entry count while it has

not. response_t::signature lives at byte offset 60, but a continuation

IOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame

payload at that offset (data[56..59]). A received frame whose payload

bytes happen to equal 0xDEADDEAD is therefore misread as "not yet

arrived", and the loop spins forever in interrupt/DPC context, causing a

CPU soft lockup.

The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt()

(PT_LS4_UNSOL and the NVMe purls path) already gate on

qla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are

present before copyi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References