CVE-2026-89847 Overview
CVE-2026-89847 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla2x00_async_iocb_timeout(), which handles timeout processing for asynchronous I/O Control Blocks (IOCBs). When the timeout path and the response Interrupt Service Routine (ISR) race, both paths can invoke sp->done() on the same Storage Request Block (SRB). The second completion writes into a freed on-stack completion structure belonging to the submitter thread, corrupting kernel memory.
Critical Impact
A race between IOCB timeout handling and response ISR completion leads to a kernel-mode use-after-free, enabling memory corruption with potential privilege escalation or denial of service.
Affected Products
- Linux kernel builds including the qla2xxx SCSI driver for QLogic Fibre Channel HBAs
- Multiple stable kernel branches (fixes distributed across eight backport commits)
- Systems using QLogic 24xx-series and later Fibre Channel adapters
Discovery Timeline
- 2026-09-16 - CVE-2026-89847 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89847
Vulnerability Analysis
The defect exists in the asynchronous IOCB timeout path within drivers/scsi/qla2xxx. When qla2x00_async_iocb_timeout() is invoked, it calls qla24xx_async_abort_cmd() to abort the outstanding request. If that abort call fails, both the SRB_LOGIN_CMD path and the SRB_CTRL_VP (or default) path scan outstanding_cmds[] for the SRB and then unconditionally call sp->done(sp, QLA_FUNCTION_TIMEOUT) without verifying whether the SRB was actually located and removed.
Concurrently, the response ISR can complete the same handle first. The ISR removes the SRB under qp_lock_ptr and invokes sp->done(), which calls complete(sp->comp). The submitter, qla24xx_control_vp(), wakes from wait_for_completion(), clears sp->comp, drops its reference, and returns. Its on-stack completion structure is reclaimed at that point.
Root Cause
The timer reference keeps the SRB allocation alive across the timeout handler, but it does not preserve the submitter's stack frame. When the timeout path then issues a second sp->done() call to qla_ctrlvp_sp_done(), that function evaluates if (sp->comp) complete(sp->comp). Because the sp->comp pointer was loaded before the submitter's NULL store, complete() writes into the freed stack frame — a classic use-after-free triggered by missing synchronization between two completion paths.
Attack Vector
Triggering the race requires inducing IOCB timeouts against a qla2xxx-managed Fibre Channel adapter while the response ISR simultaneously completes the same handle. In multi-tenant or fabric-attached environments, adversaries able to influence storage fabric behavior or Fibre Channel command timing may provoke the condition. Reliable exploitation would require precise timing to catch the completion window before the submitter's stack is overwritten by unrelated kernel activity.
The corresponding upstream fix tracks whether the timeout path successfully removed the SRB from outstanding_cmds[] and only invokes sp->done() when it did, mirroring the sp_found guard already present in qla24xx_abort_iocb_timeout().
Detection Methods for CVE-2026-89847
Indicators of Compromise
- Kernel panics or KASAN reports referencing qla_ctrlvp_sp_done, qla2x00_async_iocb_timeout, or complete() on freed memory
- Unexpected QLA_FUNCTION_TIMEOUT messages in kernel logs correlated with Fibre Channel path instability
- Stack traces implicating qla24xx_control_vp following storage fabric errors
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test kernels to surface the use-after-free during storage fault injection
- Monitor dmesg and journald for qla2xxx abort failures paired with subsequent kernel oops signatures
- Correlate Fibre Channel link flap events with kernel instability windows on QLogic-equipped hosts
Monitoring Recommendations
- Forward kernel crash telemetry and kdump artifacts to a centralized logging pipeline for triage
- Track kernel version inventory across the fleet to identify hosts running unpatched qla2xxx builds
- Alert on repeated SCSI abort failures on the same HBA, which increase the probability of hitting the race
How to Mitigate CVE-2026-89847
Immediate Actions Required
- Inventory all hosts running the qla2xxx driver with QLogic Fibre Channel HBAs and prioritize kernel updates
- Apply the stable kernel patches referenced in the upstream commits before returning affected hosts to production
- Restrict privileged local access on affected systems to reduce opportunities for race exploitation
Patch Information
The fix has been distributed across multiple stable kernel branches. Apply the vendor-supplied kernel updates that incorporate the following commits: 6e217a9482e, 71a7b6e3c7f, 7257b5e1fb6, 845d4abd92cd, 9fa1d71233a, bb45bc4bd53c, d6d856c722f, and f5b660e0b0d9. The patch adds a tracking flag so sp->done() runs only when the timeout path actually removed the SRB from outstanding_cmds[].
Workarounds
- If patching must be delayed, unload the qla2xxx module on hosts that do not require QLogic Fibre Channel connectivity
- Stabilize the storage fabric to minimize IOCB timeouts, reducing the frequency of the race window
- Blacklist the driver on non-storage nodes via /etc/modprobe.d/ where Fibre Channel is unused
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
