CVE-2026-89850 Overview
CVE-2026-89850 affects the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla2x00_fw_state_show(), which queries firmware state through a sysfs interface. When the chip is down or Enhanced Error Handling (EEH) is busy, the function sets rval to QLA_FUNCTION_FAILED and jumps to the out: label. The out: block then re-issues qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down and EEH-busy guards. This can hang the adapter during ISP reset or PCI error recovery.
Critical Impact
The flaw can trigger a mailbox command outside optrom_mutex during ISP reset or PCI error recovery, potentially hanging the Fibre Channel adapter and disrupting storage I/O.
Affected Products
- Linux kernel qla2xxx SCSI driver
- Systems using QLogic Fibre Channel host bus adapters
- Storage servers relying on qla2xxx for SAN connectivity
Discovery Timeline
- 2026-09-16 - CVE-2026-89850 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89850
Vulnerability Analysis
The qla2x00_fw_state_show() sysfs handler queries adapter firmware state on demand. The function initializes rval to QLA_FUNCTION_FAILED and branches to the out: label when either the chip is down or EEH is busy. Under normal expectations, this guard should abort the query entirely. Instead, the out: fallback evaluates rval != QLA_SUCCESS and calls qla2x00_get_firmware_state() again to try to recover state.
That retry runs outside optrom_mutex and bypasses the original chip-state guards. Issuing a mailbox command during ISP reset or PCI error recovery can hang the host bus adapter. A separate failure path also amplifies the issue: a legitimate in-lock mailbox failure is converted into a second unsynchronized mailbox attempt, compounding the race with recovery logic.
Root Cause
The root cause is flawed error-path logic in the out: block of qla2x00_fw_state_show(). Rather than treating the guard-triggered exit as a terminal condition, the block relies solely on rval to decide whether to retry the mailbox query. This conflates "guard tripped, do not query" with "query attempted and failed, retry." The fix marks firmware state as unknown in the fallback path, issuing the mailbox at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.
Attack Vector
Exploitation requires local access to read the affected sysfs attribute during a specific window when the adapter is undergoing reset or PCI error recovery. A privileged local user or monitoring agent polling firmware state via sysfs can trigger the unsafe mailbox retry. The condition is a race, and its impact is availability loss: the adapter may hang, stalling SCSI I/O to attached Fibre Channel storage.
No verified public exploit is available. See the upstream patches referenced in Linux Kernel Commit 178d984 and Linux Kernel Commit 22f44f7 for the corrected control flow.
Detection Methods for CVE-2026-89850
Indicators of Compromise
- Kernel log entries from the qla2xxx driver showing mailbox command timeouts or failures during ISP reset or PCI error recovery windows.
- Unexpected adapter hangs, offline Fibre Channel ports, or stalled SCSI I/O correlated with sysfs reads of fw_state.
- Repeated firmware-state queries from monitoring agents while the chip is marked down or EEH is busy.
Detection Strategies
- Audit systems running qla2xxx and inventory kernel versions to identify hosts predating the fix commits.
- Correlate dmesg output for qla2xxx reset messages with sysfs access patterns from monitoring tooling.
- Track SAN health telemetry for adapter resets that coincide with fw_state reads to identify at-risk hosts.
Monitoring Recommendations
- Forward kernel messages from storage hosts to a centralized log analytics platform to detect adapter hangs.
- Alert on Fibre Channel path failover events and correlate against host uptime and driver version data.
- Monitor storage monitoring agents that read /sys/class/fc_host/*/fw_state and reduce polling frequency during known reset windows.
How to Mitigate CVE-2026-89850
Immediate Actions Required
- Identify all Linux hosts running the qla2xxx driver against QLogic Fibre Channel HBAs and record kernel versions.
- Apply vendor-provided kernel updates that include the upstream fix in qla2x00_fw_state_show().
- Reduce or pause aggressive polling of adapter firmware state on production storage hosts until patched kernels are deployed.
Patch Information
The issue is resolved in the Linux kernel by ensuring the out: fallback only marks firmware state as unknown, and that the mailbox command is issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy. See the upstream stable commits: Linux Kernel Commit 178d984, Linux Kernel Commit 22f44f7, Linux Kernel Commit 7bc2bae, Linux Kernel Commit a194684, Linux Kernel Commit a6374b5, Linux Kernel Commit b6a30ba, Linux Kernel Commit cba780c, and Linux Kernel Commit e0cebe2. Consume the fix through your Linux distribution's kernel updates once released.
Workarounds
- Restrict access to sysfs firmware-state attributes to trusted operators and scripts only.
- Configure storage monitoring agents to skip firmware-state queries when adapter reset events are detected.
- Where feasible, disable or throttle continuous polling of qla2xxx firmware state on hosts pending patch deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
