CVE-2026-89857 Overview
CVE-2026-89857 is a race condition in the Linux kernel's qla2xxx SCSI driver affecting NVMe over Fibre Channel (NVMe-FC) transport. The flaw exists in qla_nvme_ls_reject_iocb(), which advances the request ring and rings the request-in doorbell without holding the required producer lock. Two callers invoke the helper without the hardware_lock held, allowing concurrent execution with normal I/O submission on the base ring. The result is corruption of ring producer state, leading to duplicated or dropped SCSI/NVMe commands on Fibre Channel host bus adapters using the QLogic driver.
Critical Impact
Concurrent access to the request ring producer state can corrupt in-flight command submission, causing duplicated or dropped commands on affected Fibre Channel HBAs.
Affected Products
- Linux kernel — drivers/scsi/qla2xxx NVMe LS reject code path
- Systems using QLogic Fibre Channel HBAs with NVMe-FC transport enabled
- Distributions shipping unpatched stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89857 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89857
Vulnerability Analysis
The vulnerability resides in the qla_nvme_ls_reject_iocb() helper in the qla2xxx driver. This helper allocates from and advances the request ring through __qla2x00_alloc_iocbs(), which assumes the hardware_lock is held, and qla2x00_start_iocbs(), which advances the ring and rings the request-in doorbell. The helper itself takes no lock.
Two callers invoke the helper without the producer lock held. The first is qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on its error path. The second is qla2xxx_process_purls_pkt(), which runs from the purex work and DPC context. Both use ha->base_qpair, whose qp_lock_ptr is the hardware_lock.
Because these paths execute without the qpair lock, they can run concurrently with normal I/O submission on the base ring. This corrupts the ring producer index and related state.
Root Cause
The root cause is a missing lock acquisition around ring producer manipulation. The helper documents no locking contract, and two of its three callers violate the implicit requirement that the hardware_lock be held. The third caller, qla2xxx_process_purls_iocb(), runs inside qla24xx_process_response_queue() with the qpair lock already held, which is why the lock cannot be acquired inside the helper itself without triggering recursive re-acquisition on the response path.
Attack Vector
Exploitation requires the ability to induce NVMe-FC Link Service traffic that triggers the reject path or purex processing on a target host with qla2xxx-managed HBAs. On systems processing Fibre Channel fabric traffic, malformed or unexpected LS requests can drive the vulnerable code paths concurrently with routine I/O, corrupting the producer ring and producing duplicated or dropped commands. This can manifest as data integrity issues or denial of service at the storage layer.
No public proof-of-concept is available, and no active exploitation has been reported.
Detection Methods for CVE-2026-89857
Indicators of Compromise
- Kernel log messages from qla2xxx reporting request ring inconsistencies, IOCB allocation failures, or unexpected NVMe LS handling errors on affected HBAs.
- Storage-layer symptoms including duplicated SCSI/NVMe completions, dropped commands, or unexplained I/O timeouts on Fibre Channel LUNs.
- Application or filesystem errors correlating with periods of high NVMe-FC LS traffic.
Detection Strategies
- Inventory Linux hosts running the qla2xxx driver with NVMe-FC enabled and compare running kernel versions against patched stable branches referenced in the upstream commits.
- Correlate storage-path errors with concurrent Fibre Channel fabric events, particularly LS requests processed through the purex work or DPC context.
- Monitor dmesg and journald for qla2xxx warnings tied to qla_nvme_ls_reject_iocb, qla2xxx_process_purls_pkt, or IOCB ring state.
Monitoring Recommendations
- Forward kernel logs from Fibre Channel storage hosts to a centralized logging platform and alert on qla2xxx ring or IOCB errors.
- Track SAN switch counters for anomalous LS traffic volumes directed at hosts using QLogic HBAs.
- Baseline NVMe-FC error and retry counters through nvme-cli and vendor tooling, alerting on sudden deviations.
How to Mitigate CVE-2026-89857
Immediate Actions Required
- Apply the upstream Linux kernel patches that take qp_lock_ptr around the two previously unlocked callers and document the helper as caller-locked.
- Update to a distribution kernel that includes the referenced stable commits for the qla2xxx NVMe LS reject fix.
- Reboot affected Fibre Channel storage hosts after kernel updates to activate the patched driver.
Patch Information
The fix acquires qp_lock_ptr using spin_lock_irqsave() around both unlocked callers, since both run in process context and nothing in the locked region sleeps. The helper is now documented as caller-locked. Refer to the upstream commits: Kernel Commit Overview, Kernel Commit Changes, Kernel Commit Summary, Kernel Commit Revision, and Kernel Commit Update.
Workarounds
- Where patching is delayed and NVMe-FC is not required, unload the qla2xxx NVMe support or disable NVMe-FC transport to eliminate the vulnerable code paths.
- Restrict fabric zoning so that only trusted initiators and targets can exchange LS traffic with affected hosts.
- Increase monitoring on Fibre Channel storage hosts to detect ring corruption symptoms and quiesce workloads if inconsistencies appear.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
