Executive brief
The Linux kernel's Qlogic qla2xxx SCSI driver contains a use-after-free vulnerability in its queue pair deletion logic. When a queue pair is torn down, the response queue is freed after the request queue, creating a window where interrupt handlers can still fire and attempt to access the already-freed request queue memory. An attacker with local access to trigger queue pair deletion could crash the kernel or potentially execute code with kernel privileges.
Technical details
The vulnerability is a use-after-free (CWE-416) in the qla2xxx_delete_qpair() function. The request queue is freed via qla25xx_delete_req_que(), but the response queue MSI-X interrupt is not released until later in qla25xx_free_rsp_que(). During this window, a response interrupt can fire, triggering qla2xxx_msix_rsp_q() which queues work (qpair->q_work) that eventually dereferences the freed rsp->req pointer in qla24xx_process_response_queue(), causing a use-after-free. The fix reorders the teardown to release the response-queue interrupt and flush pending work before freeing the request queue, preventing late completions from accessing freed memory. A local attacker capable of issuing queue pair deletion commands could trigger this race condition to cause a denial of service or kernel code execution.
Affected products
- Linux Linux kernel Multiple versions (patch backported to linux-4.19.y, linux-5.x.y, linux-6.x.y, linux-7.x.y)
Timeline
- 2026-09-16: disclosed: CVE-2026-89848 published
- 2026-07-30: patched: Upstream patch commit 505753ec2594c6af09a601f0dd60be7d840c1d2d
- 2026-09-11: patched: Backport to stable kernel 6.x