Executive brief
The Linux kernel's qla2xxx SCSI driver contains a resource leak in its flash image validation handler. When validation fails, the BSG (block generic socket) job request is not properly completed, causing it to dangle until timeout and leak kernel memory and block layer resources. This impacts systems using QLogic/Marvell Fibre Channel adapters.
Technical details
The vulnerability is a resource leak in the qla28xx_validate_flash_image() handler within the qla2xxx driver's BSG interface. The function unconditionally returns QLA_SUCCESS (0), signaling ownership of job completion to the FC BSG transport layer. However, the bsg_job_done() callback was guarded by an "if (!rval)" condition that only executes on success (rval == 0). On the error path (rval == -EINVAL), neither the driver nor the transport completes the job, causing it to remain pending until timeout, leaking block layer resources. The fix removes the conditional guard and always calls bsg_job_done(), since the function's unconditional return of QLA_SUCCESS prevents double-completion by the transport. Network reachability or authentication is not required—this is triggered by local user BSG requests to the affected handler.
Affected products
- Linux Linux kernel All versions with qla2xxx driver containing the vulnerable qla28xx_validate_flash_image() function
Timeline
- 2026-09-16: disclosed: CVE-2026-89862 published
- 2026-07-23: patched: Fix committed upstream (0fb52cc632464b0cd07f970341330466d772efe1)
- 2026-09-11: patched: Fix backported to stable kernels