CVE-2026-89853: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89853 Overview

CVE-2026-89853 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel adapters. The flaw resides in the Fabric Channel Event (FCE) trace handling path invoked during firmware dumps. Specifically, qla2x00_free_fce_trace() released and cleared the ha->fce DMA buffer while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() instead read ha->fce under hardware_lock without acquiring fce_mutex. A concurrent debugfs FCE disable can therefore free the buffer between a dump's NULL check and its copy operation.

Critical Impact
Concurrent FCE disable and firmware dump operations can trigger a kernel use-after-free of a DMA buffer, potentially leading to memory corruption or a kernel crash.

Affected Products

Linux kernel branches shipping the qla2xxx SCSI driver prior to the fix commits
Systems using QLogic Fibre Channel HBAs supported by qla2xxx
Distributions consuming stable kernel branches referenced in the upstream patches

Discovery Timeline

2026-09-16 - CVE-2026-89853 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89853

Vulnerability Analysis

The vulnerability is a classic locking-discipline mismatch that produces a use-after-free [CWE-416]. The qla2xxx driver maintains an FCE trace buffer at ha->fce, allocated as coherent DMA memory. The teardown path qla2x00_free_fce_trace() acquired only fce_mutex before calling dma_free_coherent() and clearing the pointer. However, the firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read the same pointer under hardware_lock and never take fce_mutex. The two code paths therefore synchronize on disjoint locks.

Root Cause

The root cause is inconsistent lock coverage over the ha->fce pointer and its backing DMA buffer. Producers and consumers of the buffer used different synchronization primitives, leaving the free path unable to exclude concurrent dump readers. A debugfs write that disables FCE tracing invokes the free path, which can race with an in-progress firmware dump reading the buffer.

Attack Vector

Exploitation requires local privileged access to the debugfs interface controlling FCE tracing on a host equipped with a supported QLogic Fibre Channel adapter. A user with permission to toggle FCE tracing can time a disable operation to occur while a firmware dump is executing. The resulting race can cause the dump code to read from freed DMA memory, producing kernel memory corruption, undefined data in the dump, or a crash.

The upstream fix restructures the teardown so ha->fce is unpublished under hardware_lock first, and only afterward is the lock released and dma_free_coherent() called (which may sleep). Concurrent dump readers therefore either observe a valid buffer for the full check-and-copy sequence, or see ha->fce == NULL and skip the copy.

Detection Methods for CVE-2026-89853

Indicators of Compromise

Kernel oops or panic messages referencing qla2x00_free_fce_trace, qla27xx_fwdt_entry_t264, or qla25xx_copy_fce in the call trace.
KASAN use-after-free reports on DMA memory associated with the qla2xxx driver.
Firmware dump artifacts that contain truncated or inconsistent FCE trace sections following debugfs FCE toggles.

Detection Strategies

Enable KASAN in test kernels and exercise the qla2xxx debugfs FCE controls concurrently with firmware dump triggers to surface the race.
Audit installed kernel builds against the fix commits referenced in the upstream stable tree to confirm patch presence.
Correlate dmesg output with SCSI subsystem events to identify crashes tied to FCE trace teardown.

Monitoring Recommendations

Monitor kernel logs for repeated qla2xxx fault signatures on hosts with Fibre Channel storage.
Track privileged access to /sys/kernel/debug/qla2xxx/ on production hosts and alert on unexpected FCE toggles.
Aggregate crash telemetry from storage-adjacent hosts to identify clusters correlating with dump operations.

How to Mitigate CVE-2026-89853

Immediate Actions Required

Apply the upstream stable kernel commits that unpublish ha->fce under hardware_lock before freeing the DMA buffer.
Restrict access to debugfs on production hosts so only trusted administrators can toggle qla2xxx FCE tracing.
Avoid initiating firmware dumps while any user or tool is toggling FCE state.

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits: Kernel Git Commit 41ef7ed, Kernel Git Commit 423487f, Kernel Git Commit 53298ef, Kernel Git Commit 6003e79, Kernel Git Commit 7bd308c, Kernel Git Commit 8e7a269, Kernel Git Commit edc464a, and Kernel Git Commit ef9b89f. Update via your distribution's kernel update channel once the fix is backported.

Workarounds

Disable or unmount debugfs on hosts that do not require it: mount -o remount,mode=0700 /sys/kernel/debug or umount /sys/kernel/debug.
Constrain debugfs permissions so only root can traverse the qla2xxx FCE control files.
Avoid enabling FCE tracing in environments where firmware dumps may be collected by automated tooling.

bash

# Restrict debugfs access as a temporary mitigation
mount -o remount,mode=0700 /sys/kernel/debug
chmod 0600 /sys/kernel/debug/qla2xxx/*/fce