CVE-2026-89849 (GCVE-0-2026-89849)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < 9204fb0888374083be74f799049649a17eab4191 (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < b7418198b45b327194b97f856fe8ea8daa91f3fd (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < 8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6 (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < e38041b47c29316ba79b645e2ae0b713d216b1db (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805 (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < 29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9 (git)
Affected: dd30706e73b70d67e88fdaca688db7a3374fd5de , < 0f41d07d72f2245208c45374ca8d0a1846cad667 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_dbg.c",
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9204fb0888374083be74f799049649a17eab4191",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "b7418198b45b327194b97f856fe8ea8daa91f3fd",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "e38041b47c29316ba79b645e2ae0b713d216b1db",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            },
            {
              "lessThan": "0f41d07d72f2245208c45374ca8d0a1846cad667",
              "status": "affected",
              "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_dbg.c",
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path\n\nqla2x00_status_entry() filters out non-TYPE_SRB entries and the\nSRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a\nSCSI fast path that assumes the command is an SRB_SCSI_CMD. The first\nthing on that path, qla_chk_edif_rx_sa_delete_pending(), and the\nsubsequent handling both evaluate GET_CMD_SP(sp), i.e. sp-\u003eu.scmd.cmd.\n\nThe srb u union overlays the SCSI command pointer with other command\nlayouts (bsg_job, iocb_cmd). If firmware delivers an unexpected\nSTATUS_TYPE IOCB for a non-SCSI handle, sp-\u003eu.scmd.cmd can read as a\nnon-NULL garbage pointer, bypassing the NULL checks in\nqla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and\nleading to a wild pointer dereference.\n\nReject any SRB whose type is not SRB_SCSI_CMD before entering the fast\npath. The outstanding_cmds slot is left untouched so a genuinely\nnon-SCSI command still completes through its proper handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - qla2xxx processes STATUS_TYPE IOCBs from the Fibre Channel/FCoE HBA response queue in interrupt context. A peer on the same SAN fabric can keep non-SCSI SRBs (login, CT, NACK, NVMe LS) outstanding and drive firmware completions; FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - Firmware already completes several non-SCSI types (NVMe, bidirectional, task-management) via STATUS_TYPE, and the SCSI fast path was an unguarded fall-through. Once a STATUS_TYPE IOCB names a non-SCSI handle, the type confusion is deterministic, with no race or layout outside attacker influence.\nPR:N - Fibre Channel has no host authentication by default. Fabric login, nameserver CT, target-mode NACK, and I/O completions are handled in the HBA ISR/DPC with no Linux account or capability required on the victim.\nUI:N - Response-queue processing runs automatically from the HBA interrupt and qla_do_work paths. No victim mount, open, or other user action is required.\nS:U - The type confusion and wild-pointer access occur in the host kernel that owns the qla2xxx driver. This is not a VM escape, IOMMU bypass, or other cross-authority impact.\nC:H - GET_CMD_SP(sp) overlays scsi_cmnd* with other SRB union members (bsg_job*, ctarg.iocb, ntfy, sa_ctl). Treating those live kernel pointers as scsi_cmnd yields wild reads of command and sense fields, a type-confusion primitive that can be leveraged for kernel memory disclosure.\nI:H - The same type confusion writes through the forged scsi_cmnd via scsi_set_resid and memset/memcpy of firmware sense data into cp-\u003esense_buffer. Type confusion with those kernel writes is High integrity and can hijack control flow.\nA:H - Dereferencing the overlaid non-SCSI pointer as scsi_cmnd in interrupt/completion context causes a kernel oops or panic, matching related qla_chk_edif_rx_sa_delete_pending crashes on this path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:18.117Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7418198b45b327194b97f856fe8ea8daa91f3fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e38041b47c29316ba79b645e2ae0b713d216b1db"
        },
        {
          "url": "https://git.kernel.org/stable/c/e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805"
        },
        {
          "url": "https://git.kernel.org/stable/c/29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f41d07d72f2245208c45374ca8d0a1846cad667"
        }
      ],
      "title": "scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89849",
    "datePublished": "2026-09-16T10:31:23.180Z",
    "dateReserved": "2026-09-11T19:38:34.770Z",
    "dateUpdated": "2026-09-16T14:39:18.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89849",
      "date": "2026-09-25",
      "epss": "0.00423",
      "percentile": "0.33951"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:07:12.000Z",
      "cve": "CVE-2026-89849",
      "id": "msrc_CVE-2026-89849",
      "initial_release_date": "2026-09-17T01:15:21.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89849.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_dbg.c",
                  "drivers/scsi/qla2xxx/qla_isr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9204fb0888374083be74f799049649a17eab4191",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b7418198b45b327194b97f856fe8ea8daa91f3fd",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e38041b47c29316ba79b645e2ae0b713d216b1db",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f41d07d72f2245208c45374ca8d0a1846cad667",
                    "status": "affected",
                    "version": "dd30706e73b70d67e88fdaca688db7a3374fd5de",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/qla2xxx/qla_dbg.c",
                  "drivers/scsi/qla2xxx/qla_isr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path\n\nqla2x00_status_entry() filters out non-TYPE_SRB entries and the\nSRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a\nSCSI fast path that assumes the command is an SRB_SCSI_CMD. The first\nthing on that path, qla_chk_edif_rx_sa_delete_pending(), and the\nsubsequent handling both evaluate GET_CMD_SP(sp), i.e. sp-\u003eu.scmd.cmd.\n\nThe srb u union overlays the SCSI command pointer with other command\nlayouts (bsg_job, iocb_cmd). If firmware delivers an unexpected\nSTATUS_TYPE IOCB for a non-SCSI handle, sp-\u003eu.scmd.cmd can read as a\nnon-NULL garbage pointer, bypassing the NULL checks in\nqla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and\nleading to a wild pointer dereference.\n\nReject any SRB whose type is not SRB_SCSI_CMD before entering the fast\npath. The outstanding_cmds slot is left untouched so a genuinely\nnon-SCSI command still completes through its proper handler."
          }
        ],
        "id": "CVE-2026-89849",
        "lastModified": "2026-09-16T15:18:13.230",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:52.497",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f41d07d72f2245208c45374ca8d0a1846cad667"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b7418198b45b327194b97f856fe8ea8daa91f3fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e38041b47c29316ba79b645e2ae0b713d216b1db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.