The qla2xxx SCSI driver for Linux contains a race condition in its handling of the NVMe‑FC unsolicited context list. This race condition is a form of improper synchronization, classified as CWE‑366. Entries in the unsol_ctx_head list are added and removed from multiple contexts without a common synchronisation primitive. Since the qp_lock does not serialize modifications made by different qpair threads, a concurrent add and delete (or two deletes) can corrupt the list pointers, which may cause the driver to crash or trigger a kernel fault.

Linux kernel builds that ship the qla2xxx driver containing the legacy NVMe‑FC implementation are affected. The vulnerability exists in any kernel version prior to the commit that introduced a dedicated per‑fcport spinlock; the fix is present in releases that incorporate that change. Any host using a QLogic QLA2XXX Fibre Channel adapter and running affected kernel versions, especially those exposed to NVMe‑FC traffic, is susceptible.

The CVSS score of 8.8 indicates a high severity for potential denial of service or kernel instability. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, which suggests that public exploitation is currently uncertain. The likely attack vector is from a host that can issue NVMe‑FC commands to the QLogic controller—such as a local access or a remote system able to communicate over Fibre Channel. The description does not state that arbitrary code execution is achievable; the primary consequence inferred is kernel data corruption and possible system crash.