CVE-2026-89849

CVE CVE-2026-89849EUVD EUVD-2026-80449Published 2026-09-16T10:31:23.000ZLast changed 2026-09-16T14:39:18.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 6.12.110; patch: 7.2.5; dd30706e73b70d67e88fdaca688db7a3374fd5de <0f41d07d72f2245208c45374ca8d0a1846cad667; dd30706e73b70d67e88fdaca688db7a3374fd5de <b7418198b45b327194b97f856fe8ea8daa91f3fd; 5.15; patch: 5.15.221; patch: 7.3-rc1; dd30706e73b70d67e88fdaca688db7a3374fd5de <e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805; patch: 6.6.157; dd30706e73b70d67e88fdaca688db7a3374fd5de <e38041b47c29316ba79b645e2ae0b713d216b1db; dd30706e73b70d67e88fdaca688db7a3374fd5de <29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9; dd30706e73b70d67e88fdaca688db7a3374fd5de <9204fb0888374083be74f799049649a17eab4191; patch: 0; dd30706e73b70d67e88fdaca688db7a3374fd5de <8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6; patch: 6.1.188; patch: 6.18.51

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.