CVE-2026-89860 Overview
CVE-2026-89860 is a Linux kernel vulnerability in the qla2xxx SCSI driver affecting NVMe over Fibre Channel abort handling. The flaw resides in qla_nvme_fcp_abort() and qla_nvme_ls_abort(), which called INIT_WORK() on priv->abort_work immediately before schedule_work(). When an abort is issued more than once for the same command, such as during concurrent transport teardown and a timeout-driven abort, the second INIT_WORK() reinitializes a work item that is already queued. This corrupts the workqueue list and can lead to kernel crashes or a looping worker thread.
Critical Impact
An adjacent-network attacker or local condition triggering repeated NVMe aborts can corrupt kernel workqueue state, resulting in denial of service or memory integrity impact on hosts using Qlogic Fibre Channel HBAs.
Affected Products
- Linux kernel scsi: qla2xxx driver with NVMe over Fibre Channel support
- Systems using QLogic Fibre Channel Host Bus Adapters with NVMe-FC
- Distributions shipping affected upstream kernels prior to the referenced stable patches
Discovery Timeline
- 2026-09-16 - CVE-2026-89860 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89860
Vulnerability Analysis
The vulnerability is a race condition combined with improper work item lifecycle management in the qla2xxx NVMe abort path. The INIT_WORK() macro resets the work_struct list head and clears the pending bit. Reinitializing a work_struct that is currently queued on a workqueue corrupts the doubly-linked list that the workqueue infrastructure maintains.
Exploitation manifests when two concurrent code paths, such as an NVMe transport teardown and a timeout-driven abort, both call the abort function for the same command. The second call re-runs INIT_WORK() on priv->abort_work while the first invocation's work item is still pending execution. The result is workqueue list corruption, which can escalate to a kernel oops or a worker thread that loops indefinitely consuming CPU.
Root Cause
The root cause is placement of INIT_WORK() inside the abort submission path rather than at command allocation time. The work_struct was reinitialized on every abort invocation instead of once during the command lifecycle. This violates the kernel's requirement that a work_struct must not be reinitialized while it is queued or executing.
Attack Vector
The attack vector requires conditions that generate concurrent aborts for the same NVMe-FC command. Transport-level events such as link disruption, controller reset, or induced I/O timeouts on the Fibre Channel fabric can force the double-abort scenario. The vulnerability requires adjacent-network access to the storage fabric.
The fix moves INIT_WORK() to command submission alongside the existing spin_lock_init(&priv->cmd_lock), leaving only schedule_work() in the abort paths. schedule_work() is a no-op when the work item is already pending, so repeated aborts no longer disturb an in-flight work item. The command is not returned to the transport until the final kref_put() release callback runs after abort_work has completed.
Detection Methods for CVE-2026-89860
Indicators of Compromise
- Kernel log messages referencing workqueue list corruption, such as list_add corruption or WARNING at lib/list_debug.c
- Kernel oops or panic traces originating in process_one_work or qla_nvme_fcp_abort call paths
- Sustained 100% CPU utilization by a kworker thread with no corresponding I/O progress
Detection Strategies
- Monitor dmesg and /var/log/messages for workqueue corruption warnings on hosts running the qla2xxx driver with NVMe-FC targets
- Correlate Fibre Channel transport events, controller resets, and I/O timeouts with subsequent kernel warnings to identify the double-abort race
- Track kernel version and driver module version across the fleet to identify hosts running unpatched qla2xxx
Monitoring Recommendations
- Establish baseline metrics for kworker CPU usage and alert on sustained anomalies on NVMe-FC hosts
- Ingest kernel logs into a centralized platform and create detections for workqueue warnings and qla2xxx crash signatures
- Monitor Fibre Channel fabric events that could trigger repeated abort conditions, including link flaps and target resets
How to Mitigate CVE-2026-89860
Immediate Actions Required
- Identify all Linux hosts running the qla2xxx driver with NVMe over Fibre Channel enabled
- Apply the upstream stable kernel patches referenced in the kernel.org commits as soon as vendor-supported builds are available
- Prioritize patching hosts exposed to unstable Fibre Channel fabrics or those experiencing frequent transport resets
Patch Information
The upstream fix moves INIT_WORK() to command submission time and leaves only schedule_work() in the abort paths. The patch is available in the following stable kernel commits: 67f0d51, 6a1b50c, 7e85f6d, b403700, and f4aaa4a. Coordinate with your Linux distribution vendor for backported packages.
Workarounds
- Stabilize the Fibre Channel fabric to minimize link flaps and transport resets that trigger the double-abort race
- Where operationally feasible, migrate NVMe-FC workloads to alternate transports until the patched kernel is deployed
- Reduce I/O timeout aggressiveness on affected hosts to lower the probability of concurrent timeout-driven and teardown-driven aborts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
