CVE-2026-89842: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89842 Overview

CVE-2026-89842 affects the Linux kernel's qla2xxx SCSI driver, which supports QLogic Fibre Channel host bus adapters. The flaw resides in qla_nvme_xmt_ls_rsp(), the routine that transmits NVMe Link Services (LS) responses. When firmware is not started, the function branches to a cleanup label that unconditionally emits an LS reject I/O Control Block (IOCB) and writes the request queue doorbell. This queues an IOCB the firmware cannot consume and touches memory-mapped I/O (MMIO) during reset or Enhanced Error Handling (EEH) windows. The same defect exists in qla2xxx_process_purls_pkt(). Linux kernel maintainers have merged patches to gate the reject emission on the fw_started flag.

Critical Impact
Rings the firmware doorbell and performs MMIO during firmware reset or EEH recovery, potentially causing driver instability, kernel error paths, or denial of service on hosts using QLogic Fibre Channel adapters.

Affected Products

Linux kernel qla2xxx SCSI driver (mainline versions containing the vulnerable NVMe LS reject path)
Distributions shipping affected kernels with QLogic Fibre Channel HBA support
Systems using NVMe over Fibre Channel via the qla2xxx driver

Discovery Timeline

2026-09-16 - CVE-2026-89842 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-89842

Vulnerability Analysis

The defect lives in the NVMe LS response transmission path of the qla2xxx driver. qla_nvme_xmt_ls_rsp() checks !ha->flags.fw_started and jumps to the out: label when firmware has not started. The out: path calls qla_nvme_ls_reject_iocb(), which ends in qla2x00_start_iocbs() and issues an unconditional doorbell write to the request queue in-pointer register. The driver therefore rings firmware and queues an IOCB while firmware is stopped or resetting. This behavior also touches MMIO during the Enhanced Error Handling (EEH) recovery window when fw_started is clear. The same unsafe emission exists in qla2xxx_process_purls_pkt() and is patched with the identical guard. This class of defect is a Kernel Vulnerability affecting a Driver Vulnerability surface exposed to firmware and hardware state.

Root Cause

The root cause is a missing precondition check before hardware access. The cleanup label assumed firmware was running and did not re-validate fw_started before invoking IOCB submission. The corrective patches restrict LS reject IOCB emission to code paths that run after firmware has started, while the post-allocation failure cases (SRB allocation or qla2x00_start_sp() failure) continue to send the reject because firmware is confirmed running.

Attack Vector

The issue is triggered through the NVMe LS handling path during firmware state transitions such as reset or EEH recovery. Exploitation requires interaction with the Fibre Channel fabric and specific firmware state timing rather than direct network access. Impact is limited to hosts with qla2xxx-managed adapters processing NVMe LS traffic while firmware is not started.

No verified proof-of-concept code is published. See the upstream commits linked under references for the exact patched functions and guard conditions.

Detection Methods for CVE-2026-89842

Indicators of Compromise

Kernel log entries from qla2xxx referencing IOCB submission failures, doorbell writes, or MMIO errors during adapter reset or EEH events
Repeated NVMe LS reject activity coinciding with firmware restart or fw_started transitions
Unexpected Fibre Channel link resets or NVMe subsystem disconnects on hosts running vulnerable kernels

Detection Strategies

Inventory running kernel versions with uname -r and correlate against distribution advisories that reference the upstream commits listed in the NVD entry
Monitor dmesg and journald for qla2xxx warnings tied to qla_nvme_xmt_ls_rsp or qla2xxx_process_purls_pkt code paths
Track EEH events on PowerPC systems and adapter reset counters on all platforms using QLogic HBAs

Monitoring Recommendations

Forward kernel and storage subsystem logs to a centralized platform for correlation across fleets
Alert on repeated Fibre Channel adapter resets, NVMe LS errors, and driver stack traces mentioning qla2xxx
Baseline healthy qla2xxx behavior and flag deviations that align with firmware restart windows

How to Mitigate CVE-2026-89842

Immediate Actions Required

Identify hosts running the qla2xxx driver with NVMe over Fibre Channel enabled and prioritize them for patching
Apply the vendor kernel update that incorporates the upstream fixes for qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt()
Schedule reboots on affected hosts to load the patched kernel and driver

Patch Information

Upstream fixes are available in the following Linux kernel commits. Apply the distribution kernel that includes these commits:

The patches add a fw_started guard so the LS reject IOCB is only emitted when firmware is running.

Workarounds

Where patching is not immediately possible, minimize firmware reset and EEH events by validating HBA firmware and cabling health
Reduce NVMe over Fibre Channel exposure on unpatched hosts by isolating them from paths that trigger frequent LS traffic
Coordinate with the storage vendor for adapter firmware updates that reduce reset frequency until kernel patches are deployed