HIGH Introduced in 5.15
qla2xxx ResponseQueue OOB
CVE-2026-93242
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() qla24xx_process_response_queue() advances ring_ptr past the head IOCB before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr already points at the first continuation IOCB. The function however looped purex->entry_count times starting at ring_ptr. As entry_count includes the head, this consumed one entry too many: it stamped RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring past it, silently dropping a legitimate firmware response. The head IOCB's signature was also never marked. Mark the head processed and account for it, then consume only the entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer().
02KernelScan AI Analysis
Risk summary
A remote Fibre Channel device on the same FC fabric can trigger an off-by-one error in the qla2xxx driver's response queue processing, causing the driver to consume one IOCB entry too many and silently drop a legitimate firmware response. This can lead to data loss, SCSI command timeouts, and degraded storage availability on systems using affected QLogic/Marvell FC adapters with EDIF enabled.
Vulnerability analysis
The qla2xxx FC driver's response queue consumer advances past the head IOCB entry before processing continuation entries, but the consumption loop counts the head entry in its total, causing it to process one extra entry beyond the intended chain. This stamps a 'processed' marker on an unrelated entry in the response ring and skips past it, silently dropping a legitimate firmware response and corrupting ring buffer state. The fix marks the head entry as processed and decrements the remaining count before entering the loop, so only the continuation entries are consumed. The bug is reachable by any device on the same Fibre Channel fabric sending ELS authentication messages to a host with a QLogic or Marvell FC adapter that has the EDIF (encryption-in-flight) feature active; no privileges on the target system are required, but specific FC HBA hardware must be present and the EDIF feature must be enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15 | 5.15.221 | a136c311676f |
| 6.6 | 5.15 | 6.6.157 | 6e3f129538c3 |
| 6.12 | 5.15 | 6.12.110 | bd1534d4afab |
| mainline | 5.15 | 7.3-rc1 | 3ba019bdd89d |
| 6.18 | 5.15 | 6.18.51 | 31715d1e1cbf |
| 6.1 | 5.15 | 6.1.188 | d841707fafba |
| 7.2 | 5.15 | 7.2.5 | df86c27cf1ba |
| cip/6.12 | 5.15 | 6.12.111-cip32 | bd1534d4afab |