CVE-2026-97530 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide whether the next continuation IOCB has arrived, spinning on cpu_relax() without advancing the ring or decrementing the entry count while it has not. response_t::signature lives at byte offset 60, but a continuation IOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame payload at that offset (data[56..59]). A received frame whose payload
bytes happen to equal 0xDEADDEAD is therefore misread as "not yet arrived", and the loop spins forever in interrupt/DPC context, causing a CPU soft lockup.
The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt() (PT_LS4_UNSOL and the NVMe purls path) already gate on qla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are present before copying begins. The sibling helper __qla_copy_purex_to_buffer() already drops the signature poll and relies on the entry_type == STATUS_CONT_TYPE guard instead.
Remove the signature busy-wait from both helpers, keeping the entry_type guard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers and re-processes on the next interrupt once all continuation IOCBs have arrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the signature field is never read on a continuation IOCB, eliminating the payload-aliasing lockup.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel SCSI subsystem within the qla2xxx driver contains a critical concurrency flaw that leads to system instability under specific network conditions. This vulnerability manifests as a CPU soft lockup caused by an infinite busy-wait loop in interrupt or deferred procedure call context. The root cause lies in the incorrect polling logic used to determine when continuation Input/Output Control Blocks have fully arrived from hardware. Specifically, functions qla27xx_copy_multiple_pkt and qla27xx_copy_fpin_pkt rely on checking a signature field within the response queue ring structure to verify completion status. This approach assumes that reading this specific memory location will reliably indicate whether all expected data fragments are present, but it fails to account for potential aliasing between control metadata and actual payload data.
The technical flaw stems from a misinterpretation of memory layout in continuation IOCB structures. The code polls the signature field located at byte offset sixty within the response_t structure, expecting to find the constant value 0xDEADDEAD which signifies RESPONSE_PROCESSED. However, for continuation IOCBs such as sts_cont_entry_t or struct sts_cont_entry_ext, this same memory region overlaps with raw Fibre Channel frame payload data spanning bytes fifty-six through fifty-nine. When a received FC frame contains payload bytes that coincidentally match the hex value 0xDEADDEAD, the driver incorrectly interprets this as an unprocessed state rather than valid data. Consequently, the loop spins indefinitely on cpu_relax without advancing the ring pointer or decrementing the entry count, effectively halting CPU execution in a high-priority context and causing a soft lockup that can render the system unresponsive to other interrupts.
This issue is further exacerbated by redundant safety checks that were intended to prevent race conditions but instead contributed to the logic error. The callers of these functions, including PT_LS4_UNSOL and NVMe purls paths, already employ qla_chk_cont_iocb_avail to ensure all entry_count IOCBs are present before initiating copy operations. This existing gate makes the additional signature polling unnecessary and potentially harmful when it conflicts with actual payload content. A sibling helper function __qla_copy_purex_to_buffer demonstrates a more robust approach by dropping the signature poll entirely and relying instead on an entry_type guard set to STATUS_CONT_TYPE, which provides a reliable indicator of completion without risking false positives from data aliasing.
The resolution involves removing the problematic signature busy-wait logic from both affected helper functions while preserving the necessary entry_type validation guards. For the FPIN path specifically, the fix introduces a dependency on qla_chk_cont_iocb_avail to gate processing, ensuring that the system defers and re-processes data only after all continuation IOCBs have definitively arrived via subsequent interrupts. This change aligns the behavior with established patterns used in ELS_AUTH_ELS and PT_LS4_UNSOL arms, thereby eliminating the possibility of payload aliasing triggering a lockup condition. By relying on explicit availability checks rather than speculative signature matching, the driver achieves greater stability without sacrificing performance or correctness.
From a vulnerability classification perspective, this defect aligns with CWE-835 which describes loops that spin forever due to incorrect loop termination conditions. It also relates to CWE-479 regarding missing signal handler in an interrupt service routine context where improper handling of hardware signals leads to system hangs. In terms of the MITRE ATT&CK framework, while not a direct attack vector for external adversaries, this flaw represents a Denial of Service vulnerability that could be triggered by maliciously crafted Fibre Channel frames if such traffic is permitted within the network fabric. The impact is severe as it compromises availability and requires manual intervention or reboot to recover from the soft lockup state once triggered.
Mitigation strategies primarily involve applying the kernel patch that corrects the polling logic in qla2xxx driver code paths. System administrators should ensure their Linux kernels are updated with this fix, particularly if they utilize QLogic Fibre Channel adapters handling high-throughput or mixed payload types. Additionally, network segmentation policies can be employed to restrict access to FC fabrics from untrusted sources, reducing the risk of triggering the condition through crafted frames. Monitoring tools should be configured to detect soft lockup warnings in kernel logs as an early indicator that similar concurrency issues may exist in other driver components not yet patched.