Executive brief
A race condition in the Fibre Channel to NVMe bridge driver (qla2xxx) used in storage systems can cause corrupted command queues when multiple code paths access the request ring without proper synchronization. This can lead to dropped or duplicated I/O commands, potentially causing storage service interruptions or data inconsistency.
Technical details
The vulnerability is a missing lock synchronization in qla_nvme_ls_reject_iocb(), which allocates from and advances the hardware request ring through __qla2x00_alloc_iocbs() and qla2x00_start_iocbs() functions that assume hardware_lock is held. Two callers—qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt()—invoke this function without holding the required qp_lock_ptr, creating a race condition. Both operate on ha->base_qpair, allowing concurrent access with normal I/O submission that corrupts the ring producer state. The fix applies spin_lock_irqsave/spin_unlock_irqrestore around the two unlocked callers to serialize access. A third caller already holds the lock and is safe. The vulnerability affects request ring management and can result in duplicated or dropped NVMe commands.
Affected products
- Linux Linux Kernel Unknown (affects qla2xxx SCSI driver)
Timeline
- 2026-09-16: disclosed
- 2026-07-23: patched: Patch committed by Nilesh Javali; integrated into stable kernels by Greg Kroah-Hartman