CVE-2026-97527 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
A race condition in the qla2xxx NVMe driver allows concurrent list modifications, potentially causing memory corruption and system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97527?
CVE-2026-97527 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers.
Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free.
Which versions are affected by CVE-2026-97527?
How do I fix CVE-2026-97527?
Apply the vendor's patch.
Is CVE-2026-97527 being exploited?
There is no known exploitation of CVE-2026-97527 in the wild and no public exploit code.
Sources
Also known as AZL-104226, BELL-CVE-2026-97527, DEBIAN-CVE-2026-97527, GHSA-rmg2-25hr-q94v, UBUNTU-CVE-2026-97527.