Executive brief
A bug in the Linux kernel's QLogic Fibre Channel adapter driver (qla2xxx) causes it to send commands to firmware that is not yet initialized during reset or recovery operations. This can result in system instability, crashes, or data loss on storage systems using affected QLogic host bus adapters during firmware initialization or recovery events.
Technical details
The vulnerability is a logic error in the NVMe link service (LS) response handling code in qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt(). When firmware is not started (ha->flags.fw_started is clear), the code exits but unconditionally sends an NVMe LS reject IOCB via qla_nvme_ls_reject_iocb(), which rings the hardware doorbell and writes to MMIO registers during a firmware reset/EEH window when the firmware cannot consume queued commands. This can cause undefined behavior, null dereferences, or memory access violations. The fix conditionally guards the reject IOCB emission with a check for fw_started flag, ensuring the doorbell and MMIO write only occur when firmware is ready to process commands. Network-adjacent or local privilege is not required; this is a kernel-level logic error triggered during normal firmware lifecycle events.
Affected products
- Linux Linux kernel multiple versions; patch applied to stable branches 4.14+
Timeline
- 2026-09-16: disclosed: CVE-2026-89842 published
- 2026-07-30: patched: Fix committed upstream by Nilesh Javali
- 2026-09-14: patched: Fix backported to stable kernel branches