CVE-2026-89862: Linux Kernel BSG Job Leak Vulnerability

CVE-2026-89862 Overview

CVE-2026-89862 is a resource leak vulnerability in the Linux kernel's qla2xxx SCSI driver. The flaw resides in qla28xx_validate_flash_image(), which returns QLA_SUCCESS unconditionally to the Fibre Channel Block SCSI Generic (FC BSG) transport. On the error path (rval == -EINVAL), the if (!rval) guard around bsg_job_done() prevents completion. Neither the driver nor the transport finalizes the request. The job dangles until it times out, leaking block layer resources tied to the BSG request.

Critical Impact
Repeated invocation of the affected flash-image validation path leaks BSG request resources in the kernel block layer, degrading storage subsystem stability on hosts using Qlogic FC HBAs.

Affected Products

Linux kernel scsi: qla2xxx driver (Qlogic Fibre Channel HBA driver)
Kernel branches carrying commit c2c68225b145 ("scsi: qla2xxx: Fix bsg_done() causing double free")
Systems using FC BSG transport with qla28xx adapters

Discovery Timeline

2026-09-16 - CVE-2026-89862 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89862

Vulnerability Analysis

The qla2xxx driver exposes flash image validation to userspace through the FC BSG transport. When fc_bsg_host_dispatch() invokes a BSG handler, the return value signals ownership of the request. A non-zero return tells the transport to fail the job through fail_host_msg. A zero return tells the transport that the driver will complete the job asynchronously by calling bsg_job_done().

Commit c2c68225b145 added an if (!rval) guard to a batch of BSG handlers to prevent a double free when both the driver and the transport tried to complete a failed request. That change was correct for handlers that propagate the error code upward. However, qla28xx_validate_flash_image() always returns QLA_SUCCESS regardless of internal errors, reporting failures through vendor_rsp[0] instead. The added guard therefore skips the required completion on the error path, converting a correct single-completion into a permanent leak.

Root Cause

The root cause is an inconsistent contract between the BSG handler and the FC BSG transport. qla28xx_validate_flash_image() communicates success at the transport layer while reporting an application-level error through the vendor response. The if (!rval) guard was applied uniformly without accounting for this asymmetry, breaking the completion invariant when rval == -EINVAL.

Attack Vector

The issue is triggered from local kernel/administrative context invoking flash validation through the BSG interface on a qla28xx HBA. It is a reliability defect rather than a remote code execution vector. Repeated triggering of the error path exhausts block layer request resources over time. The upstream fix removes the guard for this specific handler and always calls bsg_job_done(), relying on the fact that the function returns 0 so the transport will not complete the job a second time.

Code-level details are available in the upstream commits: kernel commit 0fb52cc6 and kernel commit e25241f9.

Detection Methods for CVE-2026-89862

Indicators of Compromise

Growth in outstanding BSG requests on hosts using qla2xxx with qla28xx HBAs, visible through block layer counters.
BSG job timeout messages in dmesg originating from fc_bsg transport tied to flash image validation calls.
Application-level errors reported in vendor_rsp[0] from flash validation utilities without a corresponding transport-level completion.

Detection Strategies

Audit running kernels for the presence of commit c2c68225b145 without the follow-up fix commits.
Correlate storage management tooling that invokes flash image validation with subsequent BSG timeouts.
Monitor block layer request accounting for unbounded growth on Fibre Channel hosts.

Monitoring Recommendations

Track kernel version and qla2xxx module version across Fibre Channel storage hosts in configuration management.
Alert on repeated bsg_job timeout entries in kernel logs for hosts with Qlogic HBAs.
Include kernel patch status for storage drivers in vulnerability management scans.

How to Mitigate CVE-2026-89862

Immediate Actions Required

Identify Linux hosts running qla2xxx with Qlogic qla28xx Fibre Channel HBAs.
Apply the upstream stable kernel updates that include the fix for qla28xx_validate_flash_image().
Avoid invoking flash image validation workflows on unpatched hosts until the fix is deployed.

Patch Information

The fix always calls bsg_job_done() in qla28xx_validate_flash_image(). Because the function returns 0 and bsg_reply->result is set to DID_OK with the error reported in vendor_rsp[0], the transport will not complete the job a second time. Apply the changes from kernel commit 0fb52cc6 and kernel commit e25241f9, or upgrade to a stable kernel release that includes both commits.

Workarounds

Restrict use of BSG-based flash validation utilities on affected hosts until patches land.
Schedule reboots into patched kernels to reclaim leaked block layer resources.
Where feasible, unload and reload the qla2xxx module during maintenance windows to clear dangling BSG state after known trigger events.

bash

# Verify the running kernel and qla2xxx module version
uname -r
modinfo qla2xxx | grep -E '^(version|srcversion|filename):'

# Check for BSG timeout messages related to Qlogic HBAs
dmesg | grep -iE 'qla2xxx|bsg'