CVE-2026-89861 Overview
CVE-2026-89861 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla24xx_report_id_acquisition(). In the format 1 code path, the driver locates a virtual port (vport) on ha->vp_list while holding vport_slock, then releases the lock before dereferencing the vport pointer. A concurrent call to qla24xx_deallocate_vp_id() can free the vport during that window, producing a use-after-free condition on kernel memory.
Critical Impact
A race between vport enumeration and deallocation can corrupt kernel memory, leading to privilege escalation, kernel crashes, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel builds shipping the qla2xxx SCSI driver prior to the patched commits
- Distributions using QLogic 24xx-series Fibre Channel host bus adapters with N_Port ID Virtualization (NPIV)
- Stable kernel branches referenced in the fix set (267533b, 4727215, 4b7f0a9, 793cede, d09ef32, d556f89, f6b3bcc, f8d2eb5)
Discovery Timeline
- 2026-09-16 - CVE-2026-89861 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89861
Vulnerability Analysis
The qla2xxx driver manages Fibre Channel HBAs and supports N_Port ID Virtualization through per-vport scsi_qla_host structures linked on ha->vp_list. During target discovery, qla24xx_report_id_acquisition() walks this list under vport_slock to match an incoming acquisition event to the correct vport.
Once the matching vport is located, the function drops vport_slock before calling qla_update_host_map() and setting the VP_IDX_ACQUIRED, REGISTER_FC4_NEEDED, and REGISTER_FDMI_NEEDED flags on the vport. No reference count is held across this window. A parallel qla24xx_deallocate_vp_id() on another CPU can unlink and free the same vport, leaving the caller operating on freed memory [CWE-416].
Root Cause
The root cause is a missing reference acquisition during lockless use of the vport pointer. Other traversals of ha->vp_list increment vref_count under vport_slock to keep the vport pinned until the caller finishes. qla24xx_report_id_acquisition() did not follow this idiom, breaking the lifetime contract that qla24xx_deallocate_vp_id() relies on when it waits for vref_count to reach zero before freeing the structure.
Attack Vector
Exploitation requires triggering concurrent vport teardown while a Fibre Channel port ID acquisition event is in flight. An attacker with the ability to induce vport add and delete operations, or to influence Fibre Channel fabric events reaching the HBA, can race the two code paths. Successful exploitation corrupts kernel heap memory, enabling denial of service or potential kernel-mode code execution. The patched code takes a vport reference under vport_slock when the matching vp is found and releases it after the last use of vp, closing the race.
Detection Methods for CVE-2026-89861
Indicators of Compromise
- Kernel oops or panic messages referencing qla24xx_report_id_acquisition, qla_update_host_map, or qla24xx_deallocate_vp_id in call traces
- KASAN use-after-free reports naming scsi_qla_host_t or vp_list slab objects
- Unexpected Fibre Channel vport disappearance correlated with SCSI subsystem faults in dmesg
Detection Strategies
- Monitor /var/log/messages and journalctl -k for qla2xxx warnings, list corruption messages, or slab-use-after-free signatures
- Enable KASAN on test kernels to surface the race during vport add/remove stress testing
- Track kernel package versions across the fleet and flag hosts running qla2xxx on unpatched builds
Monitoring Recommendations
- Alert on unexpected reboots or kernel crash dumps on hosts with QLogic Fibre Channel HBAs
- Correlate SAN fabric login/logout storms with SCSI host errors to identify race triggers
- Audit administrative activity that creates or destroys NPIV vports outside change windows
How to Mitigate CVE-2026-89861
Immediate Actions Required
- Inventory Linux systems using the qla2xxx driver, particularly SAN-attached servers and virtualization hosts with NPIV vports
- Apply distribution kernel updates that include the upstream fix set as soon as they are available
- Restrict privileged operations that create or delete Fibre Channel vports to authorized administrators
Patch Information
The fix takes a vport reference (vref_count) under vport_slock when the matching vp is found and drops it after the last use of vp, matching the reference idiom used by other ha->vp_list traversals. Patched commits are published in the stable tree as 267533b, 4727215, 4b7f0a9, 793cede, d09ef32, d556f89, f6b3bcc, and f8d2eb5.
Workarounds
- Where hardware allows, unload the qla2xxx module on hosts that do not require QLogic Fibre Channel connectivity until a patched kernel is deployed
- Avoid dynamic NPIV vport creation and deletion on unpatched hosts to reduce the chance of hitting the race window
- Enable kernel crash dump collection (kdump) so that any triggered use-after-free produces evidence for forensic review
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
