CVE-2026-89860 - Vulnerability Details

- scsi: qla2xxx: Initialize NVMe abort_work once at submission

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Initialize NVMe abort_work once at submission

qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on
priv->abort_work immediately before schedule_work(). INIT_WORK()
reinitializes the work_struct, resetting its list head and clearing the
pending bit. If an abort is issued more than once for the same command
(for example, concurrent transport teardown and a timeout-driven abort),
the second INIT_WORK() reinitializes a work item that is already queued,
which can corrupt the workqueue list and lead to crashes or a looping
worker.

Initialize priv->abort_work once at command submission, next to the
existing per-command spin_lock_init(&priv->cmd_lock), and leave only
schedule_work() in the abort paths. schedule_work() already does nothing
when the work item is still pending, so a repeated abort no longer
disturbs an in-flight work item. The command is not returned to the
transport until the final kref_put()/release callback runs after
abort_work has completed, so the work item is idle before priv is reused
and the single submission-time INIT_WORK() is safe.

Published: 2026-09-16

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when the qla2xxx NVMe driver calls INIT_WORK() on a work_struct that is already queued. Reinitializing a queued work item corrupts the workqueue list, which can cause kernel crashes or infinite worker loops. This results in loss of system availability, as the kernel may panic or misbehave after a repeated abort for the same command.

Affected Systems

The vulnerability affects Linux kernel implementations that use the qla2xxx NVMe driver. All kernel versions shipped with the driver before the patch apply to this issue; the exact versions are not enumerated in the advisory.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score is below 1%, so the probability of widespread exploitation is currently low, and it is not listed in the CISA KEV catalog. However, an attacker who can trigger concurrent aborts on a vulnerable system could destabilize the kernel, resulting in denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e473b3074104ee09227cfbba5f872e3ea15dd280`	affected	< b403700ac62fbf3c310196386e125879a182efcf
`e473b3074104ee09227cfbba5f872e3ea15dd280`	affected	< 6a1b50c4879c2e6a034e8e85f9c055f0eea157c7
`e473b3074104ee09227cfbba5f872e3ea15dd280`	affected	< 67f0d5187c29360388f7e1e503c627ec45d01089
`e473b3074104ee09227cfbba5f872e3ea15dd280`	affected	< f4aaa4a4e6f1da6f3abfd80e1917bef922287177
`e473b3074104ee09227cfbba5f872e3ea15dd280`	affected	< 7e85f6dbc85616de2172bce8eaf84b387a723cd1

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e473b3074104ee09227cfbba5f872e3ea15dd280,b403700ac62fbf3c310196386e125879a182efcf)`	affected	code_commit	—
`[e473b3074104ee09227cfbba5f872e3ea15dd280,6a1b50c4879c2e6a034e8e85f9c055f0eea157c7)`	affected	code_commit	—
`[e473b3074104ee09227cfbba5f872e3ea15dd280,67f0d5187c29360388f7e1e503c627ec45d01089)`	affected	code_commit	—
`[e473b3074104ee09227cfbba5f872e3ea15dd280,f4aaa4a4e6f1da6f3abfd80e1917bef922287177)`	affected	code_commit	—
`[e473b3074104ee09227cfbba5f872e3ea15dd280,7e85f6dbc85616de2172bce8eaf84b387a723cd1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.6.157,7.0.0)`	unaffected	semver	—
`[6.12.110,7.0.0)`	unaffected	semver	—
`[6.18.51,7.0.0)`	unaffected	semver	—
`[7.2.5,8.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a recent kernel update that includes the qla2xxx abort_work initialization fix.
If an update is not available, disable or avoid using NVMe devices driven by the qla2xxx driver until a patch is applied.
Continuously monitor the kernel logs for signs of workqueue corruption or repeated abrt_work scheduling when abort commands are issued.

Generated by OpenCVE AI on September 18, 2026 at 08:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00398.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/67f0d5187c29360388f7e1e503c627ec45d01089
https://git.kernel.org/stable/c/6a1b50c4879c2e6a034e8e85f9c055f0eea157c7
https://git.kernel.org/stable/c/7e85f6dbc85616de2172bce8eaf84b387a723cd1
https://git.kernel.org/stable/c/b403700ac62fbf3c310196386e125879a182efcf
https://git.kernel.org/stable/c/f4aaa4a4e6f1da6f3abfd80e1917bef922287177

History

Fri, 18 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abort_work once at submission qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on priv->abort_work immediately before schedule_work(). INIT_WORK() reinitializes the work_struct, resetting its list head and clearing the pending bit. If an abort is issued more than once for the same command (for example, concurrent transport teardown and a timeout-driven abort), the second INIT_WORK() reinitializes a work item that is already queued, which can corrupt the workqueue list and lead to crashes or a looping worker. Initialize priv->abort_work once at command submission, next to the existing per-command spin_lock_init(&priv->cmd_lock), and leave only schedule_work() in the abort paths. schedule_work() already does nothing when the work item is still pending, so a repeated abort no longer disturbs an in-flight work item. The command is not returned to the transport until the final kref_put()/release callback runs after abort_work has completed, so the work item is idle before priv is reused and the single submission-time INIT_WORK() is safe.
Title		scsi: qla2xxx: Initialize NVMe abort_work once at submission
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/67f0d5187c29360388f7e1e503c627ec45d01089 https://git.kernel.org/stable/c/6a1b50c4879c2e6a034e8e85f9c055f0eea157c7 https://git.kernel.org/stable/c/7e85f6dbc85616de2172bce8eaf84b387a723cd1 https://git.kernel.org/stable/c/b403700ac62fbf3c310196386e125879a182efcf https://git.kernel.org/stable/c/f4aaa4a4e6f1da6f3abfd80e1917bef922287177

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:32.263Z

Updated: 2026-09-16T14:39:23.175Z

Reserved: 2026-09-11T19:38:34.771Z

Link: CVE-2026-89860

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:53.957

Modified: 2026-09-16T15:18:13.790

Link: CVE-2026-89860

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T08:30:06Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object