CVE-2026-89845 - Vulnerability Details

- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL
check and again when assigning it to req. The map slot is cleared by
qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)
during queue teardown, while the response-queue interrupt that drives
qla2x00_error_entry() is still registered (the IRQ is released later in
qla25xx_free_rsp_que()). If the slot is set to NULL between the two
reads, req becomes NULL and is dereferenced.

Read the slot once into req and NULL-check the local before use. mq_lock
is a mutex and cannot be taken from interrupt context, so the single
read plus local check is the appropriate fix for the reported NULL
dereference.

Published: 2026-09-16

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qla2xxx SCSI driver in the Linux kernel contains a race condition where the qla2xxx error entry function reads a request‑queue map slot twice. If the slot is cleared between the two reads during queue teardown, the function later dereferences a NULL pointer, causing an immediate kernel crash. This flaw is a classic null pointer dereference (CWE‑476) and results in a denial of service by bringing the entire operating system down.

Affected Systems

All Linux kernel implementations that include the qla2xxx SCSI driver and have not yet incorporated the commit that removes the double read are impacted. This applies to standard Linux distributions running any kernel version that pre‑dates the patch. The flaw is localized to the qla2xxx driver; no other components are affected.

Risk and Exploitability

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation in the wild. The attack vector involves a race condition between the device queue teardown and the interrupt handler for a SCSI request. Such an interaction would likely require control over the device or elevated privileges to orchestrate the timing; this is inferred from the description. Nonetheless, the potential impact is severe, so patching remains the recommended course of action.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< c845f2597787ef70159a32566669e308b2807a56
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< fe04b31e386aee4cc3a18f07462af146037dc389
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< 1b995cf4157465357d66ba096e7cdaafab9972e7
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< d79376fbd2a076de82c1cd8aa0b600b300c75a44
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< 1c90b74e484ba48f31944fe04963d99e01ac3767
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< 5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< 35124cfa9898b2088ee72859e573e0876aff66fc
`a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b`	affected	< deb8abde83a799d2501f3977f6d6051000253f5e

Linux

affected

Version	Status	Constraints
`3.4`	affected	—
`0`	unaffected	< 3.4
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,c845f2597787ef70159a32566669e308b2807a56)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,fe04b31e386aee4cc3a18f07462af146037dc389)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,1b995cf4157465357d66ba096e7cdaafab9972e7)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,1c90b74e484ba48f31944fe04963d99e01ac3767)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,5dd9bec8004ba93cee8b689bf54ce294f59e5e3c)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,35124cfa9898b2088ee72859e573e0876aff66fc)`	affected	code_commit	—
`[a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b,deb8abde83a799d2501f3977f6d6051000253f5e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.4`	affected	generic	—
`[0,3.4)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the qla2xxx null dereference fix from the recent commit. This is the primary remediation step.
If a kernel update cannot be performed immediately, disable or unload the qla2xxx driver or remove the associated SCSI hardware to avoid the crash trigger.
After applying the fix or using the workaround, monitor system logs for any residual errors related to the qla2xxx driver and verify system stability under normal load.

Generated by OpenCVE AI on September 17, 2026 at 23:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7
https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767
https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc
https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56
https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44
https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e
https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389

History

Thu, 17 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.
Title		scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7 https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767 https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56 https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44 https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:19.374Z

Updated: 2026-09-16T10:31:19.374Z

Reserved: 2026-09-11T19:38:34.770Z

Link: CVE-2026-89845

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:51.720

Modified: 2026-09-16T11:16:51.720

Link: CVE-2026-89845

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-17T23:30:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object