CVE-2026-89849

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89849

Key Details

CVE	CVE-2026-89849
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

qla2x00_status_entry() filters out non-TYPE_SRB entries and the

SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a

SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first

thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the

subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.

The srb u union overlays the SCSI command pointer with other command

layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected

STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a

non-NULL garbage pointer, bypassing the NULL checks in

qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and

leading to a wild pointer dereference.

Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast

path. The outstanding_cmds slot is left untouched so a genuinely

non-SCSI command still completes through its proper handler. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89849
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89849

Source

Reference

NVD

CVE