CVE-2026-89855 Overview
CVE-2026-89855 is a race condition in the Linux kernel qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The "update cache versions without reset" sysfs reset operation (0x20261) invokes get_flash_version() to read hardware flash registers without acquiring the ha->optrom_mutex lock. Because the Vital Product Data (VPD) update path serializes the same call under optrom_mutex, concurrent access from the reset handler can interleave flash register reads and corrupt the returned data. The upstream fix wraps the get_flash_version() call in the reset path with the same mutex to match the VPD update path.
Critical Impact
Concurrent sysfs reset and VPD or optrom flash operations can corrupt flash version reads on QLogic Fibre Channel adapters, producing invalid firmware and hardware state data.
Affected Products
- Linux kernel scsi: qla2xxx driver (QLogic Fibre Channel HBAs)
- Distributions shipping affected upstream stable kernels prior to the referenced fix commits
- Server platforms using QLogic Fibre Channel host bus adapters for SAN connectivity
Discovery Timeline
- 2026-09-16 - CVE-2026-89855 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89855
Vulnerability Analysis
The qla2xxx driver exposes a sysfs interface for administrative reset operations on QLogic Fibre Channel adapters. Reset option 0x20261, described as "update cache versions without reset", invokes get_flash_version() to read firmware and boot-code version data directly from hardware flash registers. This function issues low-level register accesses that must be serialized with other concurrent flash operations.
The VPD update code path already serializes the same get_flash_version() call using ha->optrom_mutex. The reset handler at 0x20261 omitted this lock, creating a race between the reset path and any concurrent VPD or optrom flash operation. Interleaved register accesses corrupt the version data returned to userspace and can produce inconsistent driver state.
Root Cause
The root cause is missing mutex acquisition in a code path that touches shared hardware register state [Race Condition]. The get_flash_version() routine assumes exclusive access to flash registers, and callers are expected to hold ha->optrom_mutex. The reset handler for option 0x20261 violated this contract by calling the function without the lock, breaking the driver's serialization invariant.
Attack Vector
Exploitation requires the ability to trigger the sysfs reset operation on the adapter, which typically requires local privileged access to the affected host. An administrator or automation process concurrently performing VPD or optrom flash operations while another process issues reset code 0x20261 can trigger the race. The impact is data corruption in flash version reads, potentially leading to inconsistent state reported to management tools. See the upstream commits referenced below for the technical fix that adds mutex_lock(&ha->optrom_mutex) around the affected call.
The vulnerability manifests in the get_flash_version() invocation inside the reset handler. Refer to Kernel Git Commit 8d11613 and related backport commits for the exact patch content.
Detection Methods for CVE-2026-89855
Indicators of Compromise
- Unexpected or garbled firmware and boot-code version strings reported by qla2xxx sysfs attributes or vendor management tools
- Kernel log entries from qla2xxx referencing flash read errors or checksum mismatches during administrative operations
- Concurrent sysfs writes to reset attributes and VPD or optrom attributes on the same host bus adapter
Detection Strategies
- Inventory Linux hosts running the qla2xxx driver and compare kernel versions against the fixed commits listed in the upstream references
- Audit management scripts and orchestration tools that write to qla2xxx sysfs reset interfaces to identify code paths that may issue 0x20261 concurrently with flash updates
- Monitor dmesg and centralized log pipelines for qla2xxx warnings correlated with SAN administrative activity
Monitoring Recommendations
- Forward kernel logs from SAN-attached hosts to a centralized logging or SIEM platform and alert on qla2xxx error patterns
- Track sysfs write events to qla2xxx reset attributes using audit rules to detect concurrent administrative operations
- Include Fibre Channel HBA firmware and driver versions in configuration management baselines to identify unpatched systems
How to Mitigate CVE-2026-89855
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the CVE record, or install distribution kernel updates that include the fix
- Serialize administrative operations against qla2xxx adapters so that VPD, optrom, and reset operations do not run concurrently on the same host
- Restrict write access to sensitive qla2xxx sysfs attributes to trusted administrators and automation accounts
Patch Information
The upstream fix adds ha->optrom_mutex acquisition around the get_flash_version() call in the reset handler to match the serialization used by the VPD update path. The change is available in the following upstream commits: Kernel Git Commit 31bf271, Kernel Git Commit 3373549, Kernel Git Commit 7546096, Kernel Git Commit 8d11613, Kernel Git Commit 9cef42a, Kernel Git Commit ae979c5, Kernel Git Commit f1fc052, and Kernel Git Commit f606ed9.
Workarounds
- Avoid issuing sysfs reset option 0x20261 while any VPD or optrom flash operation is in progress on the same adapter
- Wrap HBA management workflows in an external lock or scheduler to ensure single-threaded access to qla2xxx administrative interfaces
- Limit exposure by removing world-writable or group-writable permissions from qla2xxx sysfs attributes and requiring elevated privileges for management tooling
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.