Executive brief
The QLA2xxx SCSI driver, which manages Fibre Channel host bus adapter firmware, has a use-after-free vulnerability in its host teardown sequence. A concurrent read of a sysfs attribute during system shutdown can access freed memory, potentially causing a crash or system instability. This affects Linux systems using QLA2xxx adapters during device removal or error recovery.
Technical details
The vulnerability is a use-after-free (CWE-416) in the qla2xxx SCSI driver. The qla84xx_put_chip() function releases the last reference to ha->cs84xx without clearing the pointer, and this occurred before scsi_remove_host() was called during teardown. A concurrent sysfs read of the 84xx_fw_version attribute between these two operations would dereference the freed ha->cs84xx in qla24xx_84xx_fw_version_show(), causing a use-after-free. The fix reorders the function calls so qla84xx_put_chip() executes after scsi_remove_host(), ensuring the sysfs attribute is removed and kernfs has drained in-flight reads before the memory is freed. No authentication or special privileges are required; the attack vector is a race condition during host teardown.
Affected products
- Linux Linux kernel Versions before the fix (commit 33d102102d925357c5fd172dd6672a27d74b3215)
Timeline
- 2026-09-16: disclosed: CVE-2026-89854 published