CVE-2026-89854: Linux Kernel SCSI QLA2XXX UAF Vulnerability

CVE-2026-89854 Overview

CVE-2026-89854 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel HBAs. The flaw occurs during host teardown, where qla84xx_put_chip() frees the ha->cs84xx structure without clearing the pointer. A concurrent sysfs read of the 84xx_fw_version attribute can then dereference the freed memory through qla24xx_84xx_fw_version_show(), triggering a use-after-free condition. The issue has been resolved by reordering the teardown sequence so that scsi_remove_host() runs before qla84xx_put_chip().

Critical Impact
A local attacker with the ability to trigger driver teardown and read the associated sysfs attribute can corrupt kernel memory, potentially leading to privilege escalation or a denial of service.

Affected Products

Linux kernel qla2xxx SCSI driver (QLogic Fibre Channel HBA driver)
Multiple stable kernel branches, as indicated by the eight upstream fix commits
Systems using QLogic ISP84xx-based Fibre Channel host bus adapters

Discovery Timeline

2026-09-16 - CVE-2026-89854 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89854

Vulnerability Analysis

The vulnerability lives in the qla2xxx driver's teardown path for QLogic ISP84xx Fibre Channel adapters. During shutdown, qla84xx_put_chip() decrements the reference count on ha->cs84xx and, when it reaches zero, releases the structure via __qla84xx_chip_release(). The pointer stored in ha->cs84xx is not cleared after the free.

Because this release ran before scsi_remove_host(), the 84xx_fw_version sysfs attribute remained visible to userspace after the underlying data structure had been freed. A read of that attribute invokes qla24xx_84xx_fw_version_show(), which dereferences the dangling ha->cs84xx pointer.

Root Cause

The root cause is an ordering bug in the driver teardown sequence combined with a missing pointer clear after free. Both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error() invoked qla84xx_put_chip() before removing the SCSI host, leaving a window where kernfs would still dispatch show() callbacks against a freed object.

Attack Vector

Exploitation requires local access and the ability to read the 84xx_fw_version sysfs attribute concurrently with a driver teardown event, such as PCI hot-remove, module unload, or a PCI error recovery path. An attacker racing the teardown can force the show callback to dereference freed memory, producing a use-after-free that may be leveraged for kernel memory corruption.

No verified public exploit code is available. See the upstream fixes for technical details, including Kernel Git Commit 122bf17 and Kernel Git Commit ae09260.

Detection Methods for CVE-2026-89854

Indicators of Compromise

Kernel oops or panic messages referencing qla24xx_84xx_fw_version_show or __qla84xx_chip_release in dmesg or /var/log/messages.
KASAN use-after-free reports naming cs84xx or the qla2xxx module on kernels built with sanitizer support.
Unexpected SCSI host removal events coinciding with sysfs reads under /sys/class/scsi_host/hostX/.

Detection Strategies

Enable KASAN on test kernels running the qla2xxx driver to surface the use-after-free deterministically during teardown races.
Audit running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts.
Alert on processes that repeatedly read 84xx_fw_version sysfs attributes on hosts equipped with QLogic ISP84xx HBAs.

Monitoring Recommendations

Forward kernel logs to a centralized logging tier and alert on qla2xxx fault signatures or general protection faults during PCI remove events.
Monitor PCI hot-plug and module unload events on Fibre Channel storage nodes for correlation with sysfs access patterns.
Track kernel version and package inventory across storage-attached hosts to confirm patch coverage.

How to Mitigate CVE-2026-89854

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution that incorporate the upstream qla2xxx teardown fix.
Restrict local access on hosts using QLogic ISP84xx Fibre Channel HBAs until patches are deployed.
Limit unprivileged read access to /sys/class/scsi_host/ attributes where operationally feasible.

Patch Information

The fix moves qla84xx_put_chip() to run after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, kernfs has drained any in-flight show() callers, so no reader can touch cs84xx before it is freed. The corrections are distributed across multiple stable branches; see Kernel Git Commit 1d8bbc4, Kernel Git Commit 2c3b17e, Kernel Git Commit 33d1021, Kernel Git Commit 8286a90, Kernel Git Commit 8c1ebca, and Kernel Git Commit fcf0804.

Workarounds

Where the qla2xxx driver is not required, blacklist the module to eliminate the affected code path entirely.
Reduce exposure by avoiding operational workflows that combine SCSI host teardown with concurrent sysfs polling of firmware version attributes.
Constrain who may trigger PCI hot-remove or module unload operations via strict privilege separation on storage-connected hosts.

bash

# Verify the running kernel contains the qla2xxx teardown fix
uname -r
modinfo qla2xxx | grep -E 'version|srcversion'

# Optional: blacklist the driver on hosts that do not need it
echo 'blacklist qla2xxx' | sudo tee /etc/modprobe.d/blacklist-qla2xxx.conf
sudo update-initramfs -u