CVE-2026-97527

A flaw was found in the Linux kernel's qla2xxx driver. An attacker communicating over a Fibre Channel storage network can cause a Denial of Service (DoS) by triggering concurrent processing of unsolicited Non-Volatile Memory Express (NVMe) requests. Because the driver fails to properly synchronize list modifications across multiple queues, this race condition corrupts internal memory pointers and leads to a kernel crash.

A race condition in the qla2xxx NVMe FC unsolicited context handling can corrupt the fcport unsol_ctx_head list because ISR DPC worker NVMe transport callback and completion paths modify the list without a common lock. Concurrent insertion and removal or two concurrent removals can corrupt list pointers and may result in use after free double free kernel memory corruption or a kernel crash. For the CVSS the PR:N because the attacker does not need local privileges on the target host, but must have access to the relevant Fibre Channel SAN fabric and be able to generate NVMe FC traffic. The attack vector is adjacent AV:A rather than Internet reachable AV:N. The race requires timing between concurrent processing contexts so AC:H is appropriate. Impact is at least denial of service and the memory corruption nature of the bug provides a plausible path to confidentiality integrity impact or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.