CVE-2026-89844 Overview
CVE-2026-89844 is a race condition vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla24xx_report_id_acquisition(), which drops the vport_slock before invoking qla_update_host_map(). That call chain reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32(), btree_update32(), and btree_remove32(). The documented locking contract requires vport_slock to be held during these mutations. Concurrent host map updates can race and corrupt the btree structure.
Critical Impact
Concurrent unlocked btree mutations can corrupt kernel memory structures, leading to loss of confidentiality, integrity, and availability on affected systems using QLogic Fibre Channel HBAs.
Affected Products
- Linux kernel branches shipping the qla2xxx SCSI driver prior to the fix
- Systems using QLogic Fibre Channel host bus adapters with N_Port ID Virtualization (NPIV) vports
- Distributions carrying the affected qla24xx_report_id_acquisition() format-1 code path
Discovery Timeline
- 2026-09-16 - CVE-2026-89844 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89844
Vulnerability Analysis
The qla2xxx driver manages QLogic Fibre Channel adapters and tracks virtual ports through a per-host host_map btree. The function qla24xx_report_id_acquisition() handles two formats of ID acquisition responses. In the format-1 handler, the code takes a vport reference under vport_slock, drops the lock, then calls qla_update_host_map() outside any serialization.
That unlocked call reaches qla_update_vp_map(), which performs btree mutations using btree_insert32(), btree_update32(), and btree_remove32(). When two CPUs execute these mutations concurrently, the btree internal state can be corrupted. Corruption of a kernel btree can produce stale pointers, incorrect lookups, use-after-free conditions, or system panics.
The format-2 path in the same function correctly wraps its SET_AL_PA host_map update in vport_slock. Only the format-1 path violated the locking contract, making the defect an inconsistency in serialization rather than a design flaw.
Root Cause
The root cause is a missing lock acquisition around a data structure mutation. The vref_count taken in the loop keeps the vport valid across the call, so lifetime is not the issue. The defect is purely a race condition on the ha->host_map btree.
Attack Vector
The CVSS vector indicates adjacent network exploitation with no privileges or user interaction required. An attacker on the same Fibre Channel fabric can trigger repeated login and port ID assignment events, driving concurrent qla24xx_report_id_acquisition() invocations. Sustained fabric activity that races vport creation, deletion, or state changes can exercise the unlocked format-1 path against a concurrent format-2 update, corrupting the btree.
The vulnerability manifests only under concurrent Fibre Channel control-plane activity. See the Linux Kernel Commit 7d0b3f7 and related stable backports for the exact fix.
Detection Methods for CVE-2026-89844
Indicators of Compromise
- Kernel panics or oops messages referencing qla_update_vp_map, btree_insert32, btree_update32, or btree_remove32
- SCSI subsystem warnings tied to qla2xxx during NPIV vport creation or fabric login storms
- Unexpected vport lookup failures or duplicate al_pa assignments on hosts with QLogic HBAs
Detection Strategies
- Monitor dmesg and /var/log/messages for qla2xxx errors correlated with Fibre Channel link events
- Enable kernel lockdep and KASAN in test environments to surface the missing-lock condition
- Track kernel package versions across the fleet and flag hosts running vulnerable qla2xxx builds
Monitoring Recommendations
- Alert on repeated Fibre Channel port login and logout cycles on hosts running QLogic adapters
- Correlate storage path failures with kernel warnings emitted from the qla2xxx driver
- Centralize kernel logs and stack traces to identify recurring faults in qla_update_vp_map()
How to Mitigate CVE-2026-89844
Immediate Actions Required
- Inventory Linux hosts running the qla2xxx driver with QLogic Fibre Channel HBAs and NPIV enabled
- Apply the vendor kernel update that holds vport_slock across the format-1 qla_update_host_map() call
- Restrict Fibre Channel fabric access to trusted zones and enforce hard zoning to limit adjacent-network exposure
Patch Information
The upstream fix moves the qla_update_host_map() call inside the vport_slock critical section in the format-1 path of qla24xx_report_id_acquisition(). Reference commits: Linux Kernel Commit 6ed66e2, Linux Kernel Commit 776e4e8, Linux Kernel Commit 7944039, Linux Kernel Commit 7d0b3f7, and Linux Kernel Commit e8f1b0c. Consume the fix through your distribution's kernel update channel.
Workarounds
- Disable NPIV vport creation on affected hosts until the patched kernel is deployed
- Enforce strict Fibre Channel zoning to prevent untrusted initiators from triggering repeated login events
- Where feasible, blacklist the qla2xxx module on hosts that do not require QLogic Fibre Channel connectivity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.