CVE-2026-89863 - Vulnerability Details

- scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction.
That command pointer can be NULL: the firmware may post a status
completion for a command that has already been returned or aborted. The
caller qla2x00_status_entry() acknowledges this on the very same status
path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command
already returned" message when it is NULL -- but that check runs only
after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the
pointer, so a NULL cmd crashes the kernel in interrupt context.

Return early when cmd is NULL, before touching cmd->sc_data_direction.

Published: 2026-09-16

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the qla2xxx SCSI driver of the Linux kernel. When the driver receives a status completion for a command that has already been returned or aborted by the firmware, it calls qla_chk_edif_rx_sa_delete_pending(). This routine obtains the SCSI command pointer via GET_CMD_SP(sp) and immediately accesses cmd->sc_data_direction. If cmd is NULL, the kernel dereferences a null pointer in interrupt context, causing a crash. The crash results in a kernel panic and a service disruption.

Affected Systems

Affected systems are Linux kernel implementations that include the qla2xxx SCSI driver before the patch commit found at git.kernel.org stable. The affected vendor is the Linux project and the product is the Linux kernel. The specific versions are not enumerated in the advisory, so all kernel releases containing the unpatched qla2xxx driver are at risk until the fix is applied.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, suggesting a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. However, an attacker with the ability to control the SCSI firmware or induce the erroneous status completion can trigger a NULL pointer dereference and force a kernel panic, leading to a denial‑of‑service event. The likely attack vector is local via compromised firmware or a privileged user with direct SCSI command access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< e479e9b148456905d12711411484b94083c8ff58
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< 2191b0034a2f1307d421782e6eceddf8eec9e7f6
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< 96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< 94bfb61478bcb207d27f8cd24fd231421059519f
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< 75fd6d041c4a325ae37f4683e6678d3015988bb0
`dd30706e73b70d67e88fdaca688db7a3374fd5de`	affected	< c20ee380ca59c5a8646750c4849969a815924e2e

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,e479e9b148456905d12711411484b94083c8ff58)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,2191b0034a2f1307d421782e6eceddf8eec9e7f6)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,94bfb61478bcb207d27f8cd24fd231421059519f)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,75fd6d041c4a325ae37f4683e6678d3015988bb0)`	affected	code_commit	—
`[dd30706e73b70d67e88fdaca688db7a3374fd5de,c20ee380ca59c5a8646750c4849969a815924e2e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the qla2xxx patch (commits 2191b0034a2f or later).
If an immediate kernel update is not possible, consider temporarily disabling the qla2xxx SCSI driver or isolating the affected hardware from critical workloads.
Monitor kernel logs for panic messages related to the qla_chk_edif_rx_sa_delete_pending routine and plan for an immediate reboot if a crash occurs.

Generated by OpenCVE AI on September 18, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.007.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2191b0034a2f1307d421782e6eceddf8eec9e7f6
https://git.kernel.org/stable/c/75fd6d041c4a325ae37f4683e6678d3015988bb0
https://git.kernel.org/stable/c/94bfb61478bcb207d27f8cd24fd231421059519f
https://git.kernel.org/stable/c/96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b
https://git.kernel.org/stable/c/c20ee380ca59c5a8646750c4849969a815924e2e
https://git.kernel.org/stable/c/de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1
https://git.kernel.org/stable/c/e479e9b148456905d12711411484b94083c8ff58

History

Fri, 18 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context. Return early when cmd is NULL, before touching cmd->sc_data_direction.
Title		scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2191b0034a2f1307d421782e6eceddf8eec9e7f6 https://git.kernel.org/stable/c/75fd6d041c4a325ae37f4683e6678d3015988bb0 https://git.kernel.org/stable/c/94bfb61478bcb207d27f8cd24fd231421059519f https://git.kernel.org/stable/c/96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b https://git.kernel.org/stable/c/c20ee380ca59c5a8646750c4849969a815924e2e https://git.kernel.org/stable/c/de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1 https://git.kernel.org/stable/c/e479e9b148456905d12711411484b94083c8ff58

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:34.377Z

Updated: 2026-09-16T14:39:25.537Z

Reserved: 2026-09-11T19:38:34.771Z

Link: CVE-2026-89863

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:54.353

Modified: 2026-09-16T15:18:14.050

Link: CVE-2026-89863

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T08:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object