CVE-2026-89848: Linux Kernel qla2xxx Use-After-Free Vulnerability

CVE-2026-89848 Overview

CVE-2026-89848 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla2xxx_delete_qpair(), which deletes the request queue before quiescing the response queue interrupt. During queue teardown, the response-queue MSI-X interrupt can still fire and dereference rsp->req after qla25xx_free_req_que() has already freed the memory via kfree(req). The kernel maintainers resolved the issue by releasing the response-queue interrupt and flushing qpair->q_work before the request queue is deleted.

Critical Impact

A race condition between interrupt handling and queue teardown can lead to kernel memory corruption, potentially resulting in denial of service or privilege escalation on systems using QLogic Fibre Channel HBAs.

Affected Products

• Linux kernel versions containing the vulnerable qla2xxx SCSI driver code path
• Systems using QLogic Fibre Channel Host Bus Adapters with multi-queue support
• Enterprise storage servers relying on qla2xxx for SAN connectivity

Discovery Timeline

• 2026-09-16 - CVE-2026-89848 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89848

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the queue-pair teardown path of the qla2xxx driver. When qla2xxx_delete_qpair() runs, it deletes the request queue first, followed by the response queue. The function qla25xx_delete_req_que() invokes qla25xx_free_req_que(), which calls kfree(req) and releases the request queue memory. However, the response-queue MSI-X interrupt remains armed until qla25xx_free_rsp_que() executes later in the teardown sequence.

In the window between these operations, the response interrupt handler qla2xxx_msix_rsp_q() can queue qpair->q_work. When qla_do_work() dispatches to qla24xx_process_response_queue(), the code dereferences rsp->req for LOGINOUT, CT, ELS entries, and along the status path. Because req has already been freed, this dereference touches reclaimed memory.

Root Cause

The root cause is an ordering defect in resource cleanup. The cancel_work_sync() call added to protect qpair teardown resides in the response-queue free path, which executes after the request queue has been freed. That synchronization therefore fails to prevent late response completions from referencing rsp->req. The firmware queue-delete order (request then response) is correct at the hardware level, but the software failed to quiesce the response IRQ before tearing down request-queue memory.

Attack Vector

Exploitation requires triggering queue-pair deletion while response traffic is in flight on a QLogic Fibre Channel HBA. An attacker with the ability to influence SCSI queue lifecycle events, or to generate Fibre Channel frames that cause LOGINOUT, CT, or ELS response entries during teardown, could race the interrupt handler against the free path. Successful exploitation corrupts kernel heap state, which may lead to a kernel panic or, with careful heap grooming, arbitrary kernel memory manipulation. The vulnerability mechanism is described in the upstream patches; see the Kernel Git Commit 7ac5be2a for the authoritative fix.

Detection Methods for CVE-2026-89848

Indicators of Compromise

• Unexpected kernel oops or panic traces referencing qla24xx_process_response_queue, qla_do_work, or qla2xxx_msix_rsp_q in dmesg or /var/log/messages.
• KASAN (Kernel Address Sanitizer) reports flagging use-after-free in qla25xx_free_req_que or on rsp->req accesses.
• Slab corruption warnings correlated with SCSI queue-pair teardown events on systems with QLogic Fibre Channel HBAs.

Detection Strategies

• Audit installed kernel versions against the fix commits listed in the upstream advisory to identify unpatched hosts.
• Enable KASAN and slab debugging on lab systems to reproduce and confirm the use-after-free during HBA queue teardown.
• Monitor kernel logs for repeated crashes tied to Fibre Channel connectivity events such as port logout, link bounce, or adapter reset.

Monitoring Recommendations

• Collect and centralize kernel ring-buffer output from storage servers to a SIEM for pattern matching on qla2xxx fault signatures.
• Track unexplained SCSI subsystem restarts or HBA driver reload events across the fleet.
• Correlate storage-array reconfiguration events, firmware upgrades, or LUN rescans with subsequent kernel instability on initiator hosts.

How to Mitigate CVE-2026-89848

Immediate Actions Required

• Inventory all Linux hosts using QLogic Fibre Channel HBAs and determine kernel versions in use.
• Apply the upstream kernel patches or vendor-supplied kernel updates that incorporate the fix.
• Schedule maintenance windows to reboot patched systems, since kernel changes require a full restart to take effect.

Patch Information

The fix reorders qpair teardown so the response-queue interrupt is released and qpair->q_work is flushed before the request queue is deleted. Clearing have_irq causes qla25xx_free_rsp_que() to skip its free_irq() call, preserving the firmware queue-delete order. The fix is available across multiple stable branches; see Kernel Git Commit 10e9f05, Kernel Git Commit 1486cc18, Kernel Git Commit 157ca7d1, Kernel Git Commit 505753ec, and Kernel Git Commit 7ac5be2a.

Workarounds

• Avoid dynamic queue-pair deletion operations on production systems until the patched kernel is deployed.
• Where feasible, unload the qla2xxx module only during scheduled downtime with no active Fibre Channel traffic.
• Isolate storage initiator hosts on stable SAN fabrics to reduce spurious link events that could trigger queue teardown paths.