FKIE_CVE-2026-89850

Vulnerability from fkie_nvd - Published: 2026-09-16 11:16 - Updated: 2026-09-16 11:16
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt. Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/178d984e8875292582e4295cf559b2b11d3c9325
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/22f44f77da496bc355479c08a0a9dbc9ad42ba42
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a194684853dceaa1d6b7a9a02bc12f479232ad9b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a6374b508893de15fee78583a95f5099d7812e85
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cba780c01f72f8585ca81ad7304097f8b12ef339
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e0cebe20dcffbed9c078fe30e2d18cd5046d9eff
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "178d984e8875292582e4295cf559b2b11d3c9325",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "cba780c01f72f8585ca81ad7304097f8b12ef339",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "22f44f77da496bc355479c08a0a9dbc9ad42ba42",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "a194684853dceaa1d6b7a9a02bc12f479232ad9b",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "a6374b508893de15fee78583a95f5099d7812e85",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            },
            {
              "lessThan": "e0cebe20dcffbed9c078fe30e2d18cd5046d9eff",
              "status": "affected",
              "version": "b6faaaf796d7bfb00e32ca5c905d55cc43e89448",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Don\u0027t query firmware state while chip is down\n\nqla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps\nto the out: label when the chip is down or EEH is busy. The out: block\nthen re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS,\ndefeating the chip-down/EEH-busy guards and issuing a mailbox command\n(outside optrom_mutex) during ISP reset or PCI error recovery, which can\nhang the adapter. It also turned a normal in-lock mailbox failure into a\nsecond unsynchronized mailbox attempt.\n\nMake the out: fallback only mark the firmware state as unknown. The\nmailbox is now issued at most once, inside optrom_mutex, and only when\nthe chip is up and not EEH-busy."
    }
  ],
  "id": "CVE-2026-89850",
  "lastModified": "2026-09-16T11:16:52.623",
  "metrics": {},
  "published": "2026-09-16T11:16:52.623",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/178d984e8875292582e4295cf559b2b11d3c9325"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/22f44f77da496bc355479c08a0a9dbc9ad42ba42"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a194684853dceaa1d6b7a9a02bc12f479232ad9b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a6374b508893de15fee78583a95f5099d7812e85"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cba780c01f72f8585ca81ad7304097f8b12ef339"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e0cebe20dcffbed9c078fe30e2d18cd5046d9eff"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.