CVE-2026-89861

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89861", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.771Z", "datePublished": "2026-09-16T10:31:32.987Z", "dateUpdated": "2026-10-19T08:53:53.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:53:53.884Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n\nIn the format 1 path, the virtual port is located on ha->vp_list while\nholding vport_slock, but the lock is dropped before vp is used:\nqla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport\ndown and free it, leading to a use-after-free.\n\nTake a vport reference (vref_count) under vport_slock when the matching\nvp is found, and drop it after the last use of\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before\nunlinking and freeing the vport, so the pointer stays valid. This\nmatches the reference idiom already used by the other ha->vp_list\ntraversals."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - qla24xx_report_id_acquisition() runs from qla24xx_process_response_queue() and the ATIO MSI-X path on firmware VP_RPT_ID IOCBs after fabric FDISC or VP_STAT_ID_CHG. QLogic CNAs speak FCoE and SANs are stretched via FCIP, so a remote SAN peer drives this without a local syscall, matching sibling CVE-2026-89848.\nAC:H - The use-after-free requires qla24xx_deallocate_vp_id() to unlink the vport and scsi_host_put() it after the ISR drops vport_slock, which occurs only during NPIV vport deletion or failed vport create, a victim state a fabric attacker cannot initiate.\nPR:N - Report-ID IOCBs are firmware completions of unauthenticated Fibre Channel fabric login and N_Port ID assignment. The interrupt path performs no Linux credential or capability check, so a fabric peer needs no account on the victim host.\nUI:N - VP_RPT_ID handling runs automatically from the HBA interrupt and qla_do_work paths when the fabric assigns or changes an NPIV port ID. Concurrent vport teardown occurs during routine NPIV delete or driver remove, without a mount, open, or other interactive victim step.\nS:U - The use-after-free is of scsi_qla_host inside the host kernel qla2xxx driver and does not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - After scsi_host_put() frees the vport, the ISR still calls qla_update_host_map() and set_bit() on the dangling scsi_qla_host. That kernel heap use-after-free enables disclosure of reused object contents.\nI:H - qla_update_host_map() writes the freed vport's d_id and inserts the dangling vha pointer into ha->host_map, and set_bit() writes vp_flags/dpc_flags on the freed object, yielding a kernel write and control-flow hijack primitive.\nA:H - Use-after-free of scsi_qla_host from interrupt or qla_do_work context produces a kernel oops or panic even when not fully exploited, taking down storage served by the adapter."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/qla2xxx/qla_mbx.c"], "versions": [{"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "d09ef32af1e05d79f29b460521a20bc4e6fd2ecf", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "267533b28ddf2c9223d30ad7e6960fa9e936428e", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "f8d2eb510c063a8ca79a5dc766a4303d3925fe83", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "47272152a13d202d98496208f9bf382c1cf4d4fb", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "d556f899964d184e6cb788f3fa9dcddcafe1ab2d", "status": "affected", "versionType": "git"}, {"version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "lessThan": "793cedee296fd819bfadc2a7ec4d52faf9c09a0a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/qla2xxx/qla_mbx.c"], "versions": [{"version": "2.6.23", "status": "affected"}, {"version": "0", "lessThan": "2.6.23", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf"}, {"url": "https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69"}, {"url": "https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e"}, {"url": "https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83"}, {"url": "https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297"}, {"url": "https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb"}, {"url": "https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d"}, {"url": "https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a"}], "title": "scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/qla2xxx/qla_mbx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d09ef32af1e05d79f29b460521a20bc4e6fd2ecf", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "267533b28ddf2c9223d30ad7e6960fa9e936428e", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "f8d2eb510c063a8ca79a5dc766a4303d3925fe83", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "47272152a13d202d98496208f9bf382c1cf4d4fb", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "d556f899964d184e6cb788f3fa9dcddcafe1ab2d", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}, {"lessThan": "793cedee296fd819bfadc2a7ec4d52faf9c09a0a", "status": "affected", "version": "2c3dfe3f6ad8daff5acdb01713e4f2b116e78136", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/qla2xxx/qla_mbx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.23"}, {"lessThan": "2.6.23", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n\nIn the format 1 path, the virtual port is located on ha->vp_list while\nholding vport_slock, but the lock is dropped before vp is used:\nqla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport\ndown and free it, leading to a use-after-free.\n\nTake a vport reference (vref_count) under vport_slock when the matching\nvp is found, and drop it after the last use of\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before\nunlinking and freeing the vport, so the pointer stays valid. This\nmatches the reference idiom already used by the other ha->vp_list\ntraversals."}], "id": "CVE-2026-89861", "lastModified": "2026-10-19T09:18:30.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:54.100", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,d09ef32af1e05d79f29b460521a20bc4e6fd2ecf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,267533b28ddf2c9223d30ad7e6960fa9e936428e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,f8d2eb510c063a8ca79a5dc766a4303d3925fe83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f7ad8daff5acdb01713e4f2b116e78136,f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,47272152a13d202d98496208f9bf382c1cf4d4fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,d556f899964d184e6cb788f3fa9dcddcafe1ab2d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2c3dfe3f6ad8daff5acdb01713e4f2b116e78136,793cedee296fd819bfadc2a7ec4d52faf9c09a0a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.23"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.23)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.270,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.221,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.51,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.5,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-16T19:30:05.622439+00:00", "updated": "2026-09-18T09:30:06.178198+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}