Executive brief
A bug in the Linux kernel's Qlogic QLA2xxx SCSI driver causes the firmware state query function to issue mailbox commands even when the hardware chip is powered down or undergoing error recovery. This can hang the storage adapter, making it unresponsive and disrupting access to storage devices connected through affected Qlogic HBAs until the system is restarted.
Technical details
The vulnerability is a logic error in the qla2x00_fw_state_show() function in drivers/scsi/qla2xxx/qla_attr.c. When the chip is down or PCI error handling (EEH) is busy, the function sets rval to QLA_FUNCTION_FAILED and jumps to an out: label. However, the cleanup block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards. This causes unsynchronized mailbox commands to be issued outside the optrom_mutex lock during ISP reset or PCI error recovery, leading to adapter hangs. The fix removes the redundant mailbox call and only marks the firmware state as unknown when queries fail. The patch was applied to multiple Linux kernel stable branches.
Affected products
- Linux Linux kernel multiple stable branches including 5.x, 6.x, and 7.x series
Timeline
- 2026-09-16: disclosed: CVE-2026-89850 published
- 2026-09-14: patched: Fix merged to kernel stable branches