CVE-2026-89848

Status: UPDATED  |  Advisory ID: CVE-2026-89848

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Quiesce response IRQ before freeing request queue

qla2xxx_delete_qpair() deletes the request queue before the response

queue. qla25xx_delete_req_que() frees the request queue memory

(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is

only released later, in qla25xx_free_rsp_que(). In that window the

response interrupt can still fire, qla2xxx_msix_rsp_q() queues

qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue()

dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the

status path), a use-after-free.

The cancel_work_sync() added for the qpair teardown lives in the

response free path, which runs after the request queue is already freed,

so it does not protect rsp->req.

Release the response-queue interrupt and flush qpair->q_work before

deleting the request queue, so no late completion can reach the freed

request queue. Clearing have_irq makes the subsequent

qla25xx_free_rsp_que() skip its free_irq(), and the firmware

queue-delete order (request then response) is preserved; the

request-delete mailbox completes on the default vector and is unaffected

by dropping the qpair response interrupt early. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References