FKIE_CVE-2026-89845

Vulnerability from fkie_nvd - Published: 2026-09-16 11:16 - Updated: 2026-09-16 11:16
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c845f2597787ef70159a32566669e308b2807a56",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "fe04b31e386aee4cc3a18f07462af146037dc389",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "1b995cf4157465357d66ba096e7cdaafab9972e7",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "d79376fbd2a076de82c1cd8aa0b600b300c75a44",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "1c90b74e484ba48f31944fe04963d99e01ac3767",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "5dd9bec8004ba93cee8b689bf54ce294f59e5e3c",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "35124cfa9898b2088ee72859e573e0876aff66fc",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            },
            {
              "lessThan": "deb8abde83a799d2501f3977f6d6051000253f5e",
              "status": "affected",
              "version": "a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha-\u003ereq_q_map[que] twice: once for the NULL\ncheck and again when assigning it to req. The map slot is cleared by\nqla25xx_free_req_que() (ha-\u003ereq_q_map[que_id] = NULL under mq_lock)\nduring queue teardown, while the response-queue interrupt that drives\nqla2x00_error_entry() is still registered (the IRQ is released later in\nqla25xx_free_rsp_que()). If the slot is set to NULL between the two\nreads, req becomes NULL and is dereferenced.\n\nRead the slot once into req and NULL-check the local before use. mq_lock\nis a mutex and cannot be taken from interrupt context, so the single\nread plus local check is the appropriate fix for the reported NULL\ndereference."
    }
  ],
  "id": "CVE-2026-89845",
  "lastModified": "2026-09-16T11:16:51.720",
  "metrics": {},
  "published": "2026-09-16T11:16:51.720",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.