CVE-2026-89853
UnknownSummary
In the Linux kernel scsi: qla2xxx driver, qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free.
Risk Assessment
A use-after-free can lead to kernel memory corruption or a system crash. The risk occurs when a firmware dump and a debugfs FCE disable happen concurrently.
Recommendation
Update the Linux kernel to a version containing the fix that unpublishes ha->fce under hardware_lock and then frees the DMA buffer after releasing the lock. Until the fix is deployed, avoid disabling FCE via debugfs during a firmware dump.
Other vulnerabilities in Linux kernel (qla2xxx)
See all- CVE-2026-89856High
In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.
- CVE-2026-89855Unknown
In the Linux kernel scsi: qla2xxx driver, the sysfs reset operation "update cache versions without reset" (0x20261) calls get_flash_version(), which reads hardware flash registers, without holding ha->optrom_mutex. The VPD update path serializes the same call under optrom_mutex, so the reset path can interleave its flash register accesses with a concurrent VPD or optrom flash operation and corrupt the reads.
- CVE-2026-89854High
In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.
- CVE-2026-89852Unknown
In the Linux kernel scsi: qla2xxx driver, the mbx_cmd_t struct is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value.
- CVE-2026-89851Unknown
In the Linux kernel scsi: qla2xxx driver, qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value (0 on success, negative errno on failure) was assigned to the unsigned long enable flag, inverting the intended logic: a valid number was treated as "disable" while a parse failure enabled FCE.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free. Unpublish ha->fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha->fce == NULL and skips it.