CVE-2026-89849: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89849 Overview

CVE-2026-89849 affects the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla2x00_status_entry(), which processes status Interrupt Output Control Block (IOCB) entries from firmware. The function fails to fully validate the SCSI Request Block (SRB) type before entering a fast path that dereferences sp->u.scmd.cmd as if the command were an SRB_SCSI_CMD. When firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, the union-overlaid pointer reads as non-NULL garbage, bypassing existing NULL checks and causing a wild pointer dereference in kernel context.

Critical Impact
A malformed or unexpected firmware-delivered STATUS_TYPE IOCB can trigger a wild pointer dereference in kernel space, resulting in memory corruption, system crash, or potential privilege escalation on affected Linux hosts using QLogic Fibre Channel HBAs.

Affected Products

Linux kernel scsi: qla2xxx driver (QLogic Fibre Channel HBA driver)
Multiple stable kernel branches referenced by fix commits 0f41d07, 29f1f9a, 8f0e31e, 9204fb0, b741819, e38041b, and e93aa3c
Systems using QLogic Fibre Channel adapters connected to Storage Area Network (SAN) fabrics

Discovery Timeline

2026-09-16 - CVE-2026-89849 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89849

Vulnerability Analysis

The qla2x00_status_entry() function in the qla2xxx driver handles status IOCB completions from QLogic Fibre Channel firmware. The function filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD, and SRB_TM_CMD SRB subtypes. Any remaining SRB then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD.

The fast path immediately calls qla_chk_edif_rx_sa_delete_pending() and evaluates GET_CMD_SP(sp), which expands to sp->u.scmd.cmd. The srb structure uses a union that overlays the SCSI command pointer with alternate command layouts including bsg_job and iocb_cmd. When a non-SCSI SRB reaches the fast path, the memory backing sp->u.scmd.cmd actually contains fields from a different union member.

This classifies as a type confusion condition leading to an out-of-bounds pointer dereference in kernel context. The garbage pointer bypasses both the NULL guard inside qla_chk_edif_rx_sa_delete_pending() and the subsequent cp == NULL check, then is dereferenced as a struct scsi_cmnd.

Root Cause

The root cause is incomplete SRB type validation before entering a code path that assumes a specific union member is active. The filter list omits at least one SRB subtype whose srb.u union layout overlaps the SCSI command pointer with unrelated data. The patch rejects any SRB whose type is not SRB_SCSI_CMD before entering the fast path, while leaving the outstanding_cmds slot intact so the correct handler can still complete the command.

Attack Vector

Exploitation requires an attacker positioned to influence Fibre Channel firmware behavior or the contents of status IOCBs delivered to the host. The CVSS vector indicates an Adjacent Network attack vector with no privileges or user interaction required. In practical terms, an attacker with access to the SAN fabric, or capable of inducing anomalous firmware responses, can trigger the wild pointer dereference. The impact spans confidentiality, integrity, and availability due to the dereference occurring in kernel context.

// Vulnerability described in prose - no verified proof-of-concept code is available.
// See kernel commit references for the exact source-level fix.

Detection Methods for CVE-2026-89849

Indicators of Compromise

Unexpected kernel oops or panic messages referencing qla2x00_status_entry, qla_chk_edif_rx_sa_delete_pending, or GET_CMD_SP in dmesg or /var/log/messages.
Sudden host disconnection from Fibre Channel targets accompanied by qla2xxx driver stack traces.
Repeated storage subsystem resets or LUN path failures on hosts using QLogic HBAs.

Detection Strategies

Monitor kernel ring buffers on Fibre Channel hosts for qla2xxx fault signatures and correlate with SAN fabric events.
Track running kernel versions against the fix commits (0f41d07, 29f1f9a, 8f0e31e, 9204fb0, b741819, e38041b, e93aa3c) and flag any host still on a vulnerable revision.
Enable kernel crash collection with kdump to capture full context on unexpected qla2xxx panics for offline analysis.

Monitoring Recommendations

Aggregate kernel logs from SAN-attached servers into a centralized logging or Security Information and Event Management (SIEM) platform.
Alert on repeated qla2xxx driver warnings, HBA link resets, or IOCB completion anomalies within short time windows.
Baseline normal Fibre Channel completion counters and alert on deviations that may indicate malformed IOCB delivery.

How to Mitigate CVE-2026-89849

Immediate Actions Required

Identify all Linux systems using the qla2xxx driver by running lsmod | grep qla2xxx and inventory their kernel versions.
Apply the vendor-supplied kernel update for your distribution that incorporates the upstream fix rejecting non-SRB_SCSI_CMD types on the status IOCB fast path.
Restrict SAN fabric access using Fibre Channel zoning and hard port binding to reduce exposure to untrusted initiators or targets.
Prioritize patching on hosts that terminate multi-tenant or externally reachable storage paths.

Patch Information

The upstream fix modifies qla2x00_status_entry() to reject any SRB whose type is not SRB_SCSI_CMD before entering the SCSI fast path, preserving the outstanding_cmds slot so genuinely non-SCSI commands complete through their correct handlers. Backports are available across stable branches via the following commits: Kernel Commit 0f41d07, Kernel Commit 29f1f9a, Kernel Commit 8f0e31e, Kernel Commit 9204fb0, Kernel Commit b741819, Kernel Commit e38041b, and Kernel Commit e93aa3c.

Workarounds

Where the qla2xxx driver is not required, blacklist it to prevent load: add blacklist qla2xxx to /etc/modprobe.d/.
Enforce strict Fibre Channel zoning to limit which initiators and targets can deliver IOCBs to the host.
Isolate storage management networks from general-purpose or untrusted network segments to reduce adjacent-network exposure.

bash

# Verify kernel version and qla2xxx driver status
uname -r
modinfo qla2xxx | grep -E '^(version|filename):'
lsmod | grep qla2xxx

# Optional: disable the driver on hosts that do not require Fibre Channel HBAs
echo 'blacklist qla2xxx' | sudo tee /etc/modprobe.d/disable-qla2xxx.conf
sudo update-initramfs -u