CVE-2026-89861

CVE-2026-89861 is a race-condition use-after-free in the Linux kernel's qla2xxx Fibre Channel host bus adapter driver (Marvell/QLogic). In qla24xx_report_id_acquisition(), the driver finds a virtual port (NPIV vport) on ha->vp_list while holding vport_slock, but then drops the lock and continues using the pointer; because no reference (vref_count) is held across that window, a concurrent qla24xx_deallocate_vp_id() can tear down and free the vport mid-use, causing a use-after-free. An attacker who can trigger vport acquisition events (fabric/switch-driven format 1 reports) at the same moment a vport is being deleted can corrupt kernel memory, leading to denial of service and potentially privilege escalation or kernel memory disclosure (CVSS 8.1). Affected systems are Linux servers with QLogic/Marvell FC HBAs running the qla2xxx driver, particularly those using NPIV virtual ports. No public proof-of-concept is known and the issue is not listed in CISA's KEV, with no confirmed exploitation in the wild.

What to do: Apply kernel updates that include the fix commit, which takes a vport reference under vport_slock in qla24xx_report_id_acquisition(); track your distribution's kernel advisory for the backported patch since no fixed version numbers are given here. Check whether the qla2xxx module is loaded and whether NPIV vports exist (e.g., /sys/class/fc_vports) — systems without qla2xxx FC HBAs or without vports are not practically exposed. Avoid concurrent vport creation/deletion operations during fabric reconfiguration events as an interim risk reduction, and monitor Marvell/QLogic and distribution advisories.