Executive brief
A race condition in the Linux kernel's qla2xxx SCSI driver allows a virtual port to be deallocated while still in use, potentially causing system crashes or data corruption. This affects systems using QLogic/Cavium Fibre Channel adapters, particularly in virtualized environments. The vulnerability requires local access and specific timing conditions to trigger.
Technical details
A use-after-free vulnerability exists in the qla2xxx SCSI driver's qla24xx_report_id_acquisition() function. The vulnerable code locates a virtual port in the vport_list under spinlock protection, then releases the lock before using the vport pointer. During this window, a concurrent call to qla24xx_deallocate_vp_id() can deallocate and free the vport structure. The fix adds atomic reference counting (vref_count) to ensure the vport remains valid: an atomic increment under spinlock when located, followed by an atomic decrement after all uses. This prevents teardown until the reference count reaches zero, matching the reference-counting idiom already used elsewhere in the driver.
Affected products
- Linux Linux Kernel 2.6.11 through 6.19 and later (all versions with qla2xxx driver)
Timeline
- 2026-09-16: disclosed: CVE-2026-89861 published
- 2026-07-23: patched: Upstream fix committed (commit 793cedee296fd819bfadc2a7ec4d52faf9c09a0a)
- 2026-09-14: patched: Patch merged to Linux stable branches