Executive brief
The Linux kernel's qla2xxx SCSI driver contains a flaw in its NVMe abort handling that can corrupt the kernel's work queue and cause system crashes or hung processes. When multiple abort requests are issued for the same NVMe command—for example during concurrent network teardown and timeout conditions—the work queue data structures can become corrupted, leading to system instability and potential denial of service.
Technical details
The vulnerability exists in the qla2xxx driver's NVMe abort functions (qla_nvme_fcp_abort and qla_nvme_ls_abort) which call INIT_WORK() to reinitialize a work_struct immediately before scheduling it. INIT_WORK() resets the work_struct's list head and clears the pending bit; if called a second time on an already-queued work item, this corrupts the workqueue's internal list structure. When concurrent aborts occur (transport teardown + timeout-driven abort), the second INIT_WORK() corrupts the queued work item, leading to workqueue list corruption, kernel crashes, or infinite worker loops. The fix moves INIT_WORK() to command submission time (in qla_nvme_ls_req and qla_nvme_post_cmd) alongside existing spinlock initialization, leaving only schedule_work() in the abort paths. Since schedule_work() safely ignores already-pending work items, repeated aborts no longer disturb in-flight operations.
Affected products
- Linux Linux kernel multiple versions through at least 6.x (affected since introduction of FC-NVMe abort processing)
Timeline
- 2026-09-16: disclosed
- 2026-07-23: patched