CVE-2026-89847

The qla2xxx SCSI driver in the Linux kernel (used for QLogic/Marvell Fibre Channel host bus adapters) contains a double-completion bug that leads to a use-after-free. When an async IOCB times out, qla2x00_async_iocb_timeout() tries to abort it; if the abort fails, both the SRB_LOGIN_CMD and SRB_CTRL_VP/default paths call sp->done() unconditionally without first confirming the command was actually found and removed from outstanding_cmds[]. If the response ISR completes the same handle concurrently, the submitter (e.g., qla24xx_control_vp()) wakes, clears sp->comp and reclaims its on-stack completion, so the timeout handler's second sp->done() call can invoke complete() on a freed stack frame. An attacker who can trigger IOCB timeouts on a system with an affected HBA gains kernel memory corruption, with denial of service and potentially privilege escalation; the flaw is scored 9.8 (critical) by the kernel.org CNA, though practical triggering requires these timeout race conditions on hosts using the qla2xxx driver. No public PoC or known exploitation exists.

What to do: Patch by updating to a kernel that includes the qla2xxx fix (track the commit through kernel.org stable trees and your distro's security updates; no fixed version number is published in the available data). Inventory hosts for qla2xxx (e.g., loaded module or QLogic FC adapters via lspci) and note whether NPIV/virtual ports are in use, as those configurations exercise the affected path. No practical mitigation exists beyond patching; the flaw is not remotely reachable over IP networks despite the AV:N CVSS vector.