CVE-2026-93242 - Vulnerability Details

- scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

qla24xx_process_response_queue() advances ring_ptr past the head IOCB
before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr
already points at the first continuation IOCB. The function however
looped purex->entry_count times starting at ring_ptr. As entry_count
includes the head, this consumed one entry too many: it stamped
RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring
past it, silently dropping a legitimate firmware response. The head
IOCB's signature was also never marked.

Mark the head processed and account for it, then consume only the
entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer().

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SCSI driver for QLogic qla2xxx contains a logic flaw in the response queue handling routine __qla_consume_iocb(). The routine incorrectly consumes one entry too many, marking a non‑related IOCB as processed and silently discarding a legitimate firmware reply while the signature of the head IOCB remains unmarked. This off‑by‑one error can result in the loss of important device responses, leading to device malfunction or a denial of service if the driver behaves unreliably.

Affected Systems

All Linux kernel releases that include the qla2xxx SCSI driver supporting QLogic QLA24xx and QLA34xx hosts are affected across all distributions and kernel versions until the patch is applied.

Risk and Exploitability

The vulnerability is unscored in CVSS and EPSS data is unavailable; it is not listed in the CISA KEV catalog. Attackers would need the ability to send crafted firmware responses to the host—typically requiring local privileged access or control of the SCSI target. If successful, the flaw could cause service interruption for the affected device stack, potentially impacting system availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< a136c311676fd1010b1bde3bcfd410caa2fa040f
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< d841707fafba5f80341b82e8c3a4c24fc5aa5132
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< 6e3f129538c32d0019437197735912308c161843
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< bd1534d4afab47f13dfc27fff6f59dd859a0ac3a
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< 31715d1e1cbf3a37ce3452635c5602f73fd7abd4
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< df86c27cf1ba9d66f737a1fa56479c6e7efafe4e
`fac2807946c10b9a509b9c348afd442fa823c5f7`	affected	< 3ba019bdd89d931499d9476456b5d9c7ab7fa753

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fac2807946c10b9a509b9c348afd442fa823c5f7,a136c311676fd1010b1bde3bcfd410caa2fa040f)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,d841707fafba5f80341b82e8c3a4c24fc5aa5132)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,6e3f129538c32d0019437197735912308c161843)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,bd1534d4afab47f13dfc27fff6f59dd859a0ac3a)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,31715d1e1cbf3a37ce3452635c5602f73fd7abd4)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,df86c27cf1ba9d66f737a1fa56479c6e7efafe4e)`	affected	code_commit	—
`[fac2807946c10b9a509b9c348afd442fa823c5f7,3ba019bdd89d931499d9476456b5d9c7ab7fa753)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel patch that corrects the __qla_consume_iocb() off‑by‑one logic in the qla2xxx driver, as described in the official kernel commit log
If the patch is postponed, disable the qla2xxx driver or replace the target hardware with a vendor‑supplied firmware that implements the fixed driver path
Monitor kernel and SCSI device logs for unexpected response drops or errors and perform integrity checks on firmware communication pathways

Generated by OpenCVE AI on September 25, 2026 at 11:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00224.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31715d1e1cbf3a37ce3452635c5602f73fd7abd4
https://git.kernel.org/stable/c/3ba019bdd89d931499d9476456b5d9c7ab7fa753
https://git.kernel.org/stable/c/6e3f129538c32d0019437197735912308c161843
https://git.kernel.org/stable/c/a136c311676fd1010b1bde3bcfd410caa2fa040f
https://git.kernel.org/stable/c/bd1534d4afab47f13dfc27fff6f59dd859a0ac3a
https://git.kernel.org/stable/c/d841707fafba5f80341b82e8c3a4c24fc5aa5132
https://git.kernel.org/stable/c/df86c27cf1ba9d66f737a1fa56479c6e7efafe4e

History

Fri, 25 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Thu, 24 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() qla24xx_process_response_queue() advances ring_ptr past the head IOCB before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr already points at the first continuation IOCB. The function however looped purex->entry_count times starting at ring_ptr. As entry_count includes the head, this consumed one entry too many: it stamped RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring past it, silently dropping a legitimate firmware response. The head IOCB's signature was also never marked. Mark the head processed and account for it, then consume only the entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer().
Title		scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31715d1e1cbf3a37ce3452635c5602f73fd7abd4 https://git.kernel.org/stable/c/3ba019bdd89d931499d9476456b5d9c7ab7fa753 https://git.kernel.org/stable/c/6e3f129538c32d0019437197735912308c161843 https://git.kernel.org/stable/c/a136c311676fd1010b1bde3bcfd410caa2fa040f https://git.kernel.org/stable/c/bd1534d4afab47f13dfc27fff6f59dd859a0ac3a https://git.kernel.org/stable/c/d841707fafba5f80341b82e8c3a4c24fc5aa5132 https://git.kernel.org/stable/c/df86c27cf1ba9d66f737a1fa56479c6e7efafe4e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:40:26.570Z

Updated: 2026-09-24T15:40:26.570Z

Reserved: 2026-09-17T16:02:15.095Z

Link: CVE-2026-93242

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:20.090

Modified: 2026-09-24T16:17:20.090

Link: CVE-2026-93242

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T11:15:05Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object