Executive brief
The Linux kernel's Fibre Channel qla2xxx SCSI driver contains a race condition in its ID acquisition handling code. When processing certain Fibre Channel topology messages, the driver fails to properly lock critical data structures during host map updates, allowing concurrent operations to corrupt the internal B-tree structure that tracks port mappings. This can cause the SCSI driver to malfunction, leading to lost connectivity, I/O errors, or system instability in environments using Qlogic/Marvell Fibre Channel HBAs.
Technical details
The vulnerability is a race condition (CWE-362) in the qla2xxx driver's qla24xx_report_id_acquisition() function. The code takes a lock (vport_slock) to acquire a virtual port reference, then drops the lock before calling qla_update_host_map(), which internally modifies the ha->host_map B-tree using btree_insert32(), btree_update32(), and btree_remove32(). This mutex-protected operation is documented to require vport_slock to be held. Concurrent host map updates from other code paths can race this unlocked update and corrupt the B-tree structure. The attack vector requires network reachability to trigger Fibre Channel topology messages; no user authentication is needed. The fix wraps the qla_update_host_map() call in the missing spin_lock/unlock pair. A patch is available and has been merged into stable kernel branches.
Affected products
- Linux Linux kernel 5.0 and later (specific versions with qla2xxx containing the vulnerable code path)
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Fix merged into stable kernel branches