CVE-2026-89845 Overview
CVE-2026-89845 is a NULL pointer dereference vulnerability in the Linux kernel qla2xxx SCSI driver. The flaw resides in the qla2x00_error_entry() function, which reads ha->req_q_map[que] twice — once for a NULL check and again when assigning the pointer to req. During queue teardown, qla25xx_free_req_que() clears the map slot under mq_lock while the response-queue interrupt that drives qla2x00_error_entry() is still registered. If the slot transitions to NULL between the two reads, req becomes NULL and is dereferenced in interrupt context.
Critical Impact
A race between queue teardown and an active response-queue interrupt can trigger a kernel NULL pointer dereference, resulting in a kernel oops and denial of service on systems using QLogic Fibre Channel HBAs.
Affected Products
- Linux kernel with the qla2xxx SCSI driver enabled
- Systems using QLogic Fibre Channel Host Bus Adapters supported by qla2xxx
- Stable kernel branches referenced in the upstream commits associated with this fix
Discovery Timeline
- 2026-09-16 - CVE-2026-89845 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89845
Vulnerability Analysis
The qla2xxx driver manages multiple request and response queues for QLogic Fibre Channel HBAs. The qla2x00_error_entry() function processes error completions delivered through the response-queue interrupt path. It uses the queue index que to look up the corresponding request queue in the ha->req_q_map[] array.
The function performs two independent reads of the same array slot. The first read supports a NULL check intended to guard against a torn-down queue. The second read stores the pointer into the local variable req, which is subsequently dereferenced. Because both reads occur without protection against concurrent modification, the pointer value can change between them.
The teardown path, qla25xx_free_req_que(), sets ha->req_q_map[que_id] = NULL while holding mq_lock. The response-queue interrupt remains registered until later in qla25xx_free_rsp_que(), so an interrupt can still fire and enter qla2x00_error_entry() while teardown is in progress.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) race combined with a NULL pointer dereference. The double-read pattern allows the checked value and the used value to differ. Because mq_lock is a mutex, it cannot be acquired from interrupt context, so locking is not an option on the interrupt side.
Attack Vector
This is a local, race-condition-driven flaw rather than a remotely exploitable vulnerability. It is triggered by workloads that dynamically add and remove request queues while the adapter is generating error completions. The upstream fix reads the map slot once into a local variable and then NULL-checks the local before use, eliminating the window between check and use.
No verified public exploitation code is available for this issue. The corrective commits are published on git.kernel.org and describe the single-read fix in qla2x00_error_entry().
Detection Methods for CVE-2026-89845
Indicators of Compromise
- Kernel oops or panic messages referencing qla2x00_error_entry in the call stack
- NULL pointer dereference traces originating in the qla2xxx interrupt handler
- Sudden loss of SCSI paths on Fibre Channel LUNs following queue reconfiguration events
- dmesg entries containing qla2xxx errors correlated with request-queue teardown operations
Detection Strategies
- Collect kernel crash dumps (kdump) and inspect faulting instructions within qla2x00_error_entry() for evidence of a NULL req dereference.
- Correlate storage subsystem instability with kernel version to identify hosts running unpatched qla2xxx code.
- Track kernel package versions across the fleet and flag hosts running kernels without the referenced stable commits.
Monitoring Recommendations
- Forward dmesg and /var/log/messages to a centralized log store and alert on qla2xxx NULL pointer traces.
- Monitor SCSI path failures and multipath events on hosts equipped with QLogic Fibre Channel HBAs.
- Track kernel oops counters exposed via kernel.oops_count and node-level metrics to catch intermittent races.
How to Mitigate CVE-2026-89845
Immediate Actions Required
- Inventory all Linux hosts using the qla2xxx driver and record their running kernel versions.
- Apply the vendor kernel update that incorporates the upstream fix for qla2x00_error_entry().
- Avoid dynamic request-queue teardown operations on affected kernels until patching is complete.
- Ensure crash-dump collection is enabled to capture forensic data if the race triggers.
Patch Information
The fix reads ha->req_q_map[que] once into a local variable and then performs the NULL check against the local, removing the double-read window. The corrective changes are available in the upstream stable tree via the following commits: 1b995cf4, 1c90b74e, 35124cfa, 5dd9bec8, c845f259, d79376fb, deb8abde, and fe04b31e. Rebuild and reboot into the patched kernel from your Linux distribution vendor.
Workarounds
- No robust in-kernel workaround exists because mq_lock is a mutex and cannot be taken from interrupt context.
- Refrain from operations that trigger qla25xx_free_req_que() — such as dynamic queue reconfiguration — on unpatched systems.
- Where feasible, migrate critical storage workloads off affected hosts until the patched kernel is deployed.
# Verify running kernel and qla2xxx module version
uname -r
modinfo qla2xxx | grep -E '^(version|filename):'
# Check for recent qla2xxx-related kernel messages
dmesg -T | grep -i qla2xxx
# Debian/Ubuntu example: apply the latest kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
