CVE-2026-89863: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89863 Overview

CVE-2026-89863 is a NULL pointer dereference vulnerability in the Linux kernel qla2xxx SCSI driver. The flaw resides in the qla_chk_edif_rx_sa_delete_pending() function, which retrieves a SCSI command pointer via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction without a NULL check. Firmware can post status completions for commands that have already been returned or aborted, resulting in a NULL command pointer. When this occurs, the kernel crashes in interrupt context. The upstream fix returns early when cmd is NULL, before touching sc_data_direction.

Critical Impact
A NULL pointer dereference in interrupt context crashes the Linux kernel, producing a denial-of-service condition on affected systems running the qla2xxx Fibre Channel driver with EDIF enabled.

Affected Products

Linux kernel with the qla2xxx SCSI driver compiled in
Systems using QLogic Fibre Channel HBAs with EDIF (Encryption of Data In Flight)
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89863 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89863

Vulnerability Analysis

The vulnerability lives in the SCSI status completion path of the qla2xxx driver. The helper qla_chk_edif_rx_sa_delete_pending() accepts a srb structure and calls GET_CMD_SP(sp) to obtain the associated SCSI command. It then dereferences cmd->sc_data_direction to decide whether to process an RX SA delete request. No validation confirms that cmd is non-NULL before this access.

The caller qla2x00_status_entry() already handles the NULL case, but only after the helper has run. When firmware posts a completion for a command that has been returned or aborted, sp->cmd is NULL. The dereference then triggers a kernel oops on the interrupt path. This makes the crash unrecoverable within the ISR context and typically panics the host.

Root Cause

The root cause is missing NULL validation on a shared data structure that can be updated asynchronously by firmware and the SCSI midlayer. The helper trusts that GET_CMD_SP(sp) returns a live command, an assumption that does not hold across the abort and completion race window.

Attack Vector

Exploitation requires firmware behavior that posts a status completion for an already-returned or aborted command. This is a race condition that can be triggered under heavy I/O load, aborts, or link events on Fibre Channel fabrics using EDIF. The CVSS vector indicates network-adjacent triggering with no privileges required and an availability-only impact. Successful triggering crashes the kernel, denying service to all workloads on the host.

No verified proof-of-concept code is publicly available. See the upstream commits listed in the references for the exact code change: Kernel Git Commit 94bfb61 and Kernel Git Commit e479e9b.

Detection Methods for CVE-2026-89863

Indicators of Compromise

Kernel oops or panic messages referencing qla_chk_edif_rx_sa_delete_pending or qla2x00_status_entry in dmesg or /var/log/messages.
Unexpected host reboots correlated with Fibre Channel link events, target aborts, or EDIF key rotations.
SCSI midlayer log entries containing the string Command already returned immediately before or after a crash.

Detection Strategies

Inventory Linux hosts using QLogic Fibre Channel HBAs and confirm whether the qla2xxx module is loaded with lsmod | grep qla2xxx.
Compare running kernel versions against the fixed commits referenced in the NVD entry to identify unpatched systems.
Aggregate kernel crash telemetry centrally and alert on stack traces containing qla2xxx EDIF symbols.

Monitoring Recommendations

Forward kdump crash artifacts and serial console output to a central logging system for post-crash forensics.
Monitor Fibre Channel fabric events and correlate them with host availability metrics to detect the race window.
Track kernel package versions across the fleet to confirm patch deployment status over time.

How to Mitigate CVE-2026-89863

Immediate Actions Required

Apply the vendor-provided stable kernel update that includes the NULL check fix for qla_chk_edif_rx_sa_delete_pending().
Prioritize patching on hosts running production workloads over Fibre Channel with EDIF enabled.
Reboot patched systems to load the fixed kernel, since the change is in a compiled-in driver path.

Patch Information

The fix has been merged into the upstream Linux stable tree across multiple maintained branches. Refer to the commits: 2191b00, 75fd6d0, 94bfb61, 96eb8a3, c20ee38, de0c8ef, and e479e9b. Consume the fix through your Linux distribution's kernel update channel.

Workarounds

Disable EDIF on affected Fibre Channel links where operational policy permits, removing the code path that triggers the dereference.
Unload the qla2xxx module on hosts that do not require Fibre Channel connectivity until patched kernels are deployed.
Restrict access to storage fabric management interfaces to reduce the chance of induced link events that widen the race window.

bash

# Verify running kernel and qla2xxx driver status
uname -r
modinfo qla2xxx | grep -E '^(version|filename):'
dmesg | grep -i qla2xxx | tail -50

# On distributions using DNF or APT, apply the latest kernel update
sudo dnf update kernel && sudo reboot
# or
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-) && sudo reboot