Answer in brief
CVE-2026-97527 records a High severity (CVSS 8.8) vulnerability in scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=875386b98857822b77ac7f95bdf367b70af5b78c <b211d138cad86f749826d6132db6388eded992d8 || >=875386b98857822b77ac7f95bdf367b70af5b78c <4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0 || >=875386b98857822b77ac7f95bdf367b70af5b78c <76da0c43c63eb0496649e372ac64466364d0fe7d | b211d138cad86f749826d6132db6388eded992d8, 4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0, 76da0c43c63eb0496649e372ac64466364d0fe7d |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx_head list is modified from several contexts without a common lock. Entries are added in qla2xxx_process_purls_iocb() from the response queue ISR (under the qpair qp_lock), while they are removed from qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB completion). The qpair qp_lock cannot serialize this per-fcport list since multiqueue adapters add entries through different qpairs, so a concurrent add and delete (or two concurrent deletes) can corrupt the list pointers. Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del() on unsol_ctx_head. The add nests under the existing qp_lock; no delete path takes qp_lock, so the lock order is consistent and deadlock free.
Quoted source text, attributed separately from HOL analysis.