Executive brief
The Linux kernel's Fibre Channel SCSI driver (qla2xxx) contains a use-after-free vulnerability in its async I/O command completion handler. When command timeouts and ISR completions race, a completion callback can write to freed stack memory, leading to kernel memory corruption and potential code execution. This affects systems using Fibre Channel storage connectivity and can cause system crashes or be exploited for privilege escalation.
Technical details
A race condition exists in qla2x00_async_iocb_timeout() in drivers/scsi/qla2xxx/qla_init.c. When an async IOCB (I/O Control Block) times out and qla24xx_async_abort_cmd() fails, the timeout handler unconditionally calls sp->done() after removing the SRB (Scatter-Gather Request Block) from outstanding_cmds[]. However, if the response ISR completes the same handle first, it already removes the SRB and invokes sp->done(), which calls complete() on an on-stack completion object. After the submitter wakes and reclaims the stack frame, the timeout handler then executes a second sp->done() call, writing into the freed stack memory. The fix introduces a "found" guard variable to track whether the timeout path actually removed the SRB from outstanding_cmds[], ensuring sp->done() is called exactly once. A patch is available in upstream Linux and stable kernel branches.
Affected products
- Linux Linux kernel Affected versions across stable branches (linux-4.x, linux-5.x, linux-6.x and later)
Timeline
- 2026-09-16: disclosed: CVE-2026-89847 published
- 2026-09-14: patched: Patch committed to stable kernel branches by Greg Kroah-Hartman
- 2026-07-30: other: Original upstream commit by Nilesh Javali