https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 06:37:23 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89853 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump</p> <p>qla2x00_free_fce_trace() freed and cleared ha-&gt;fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha-&gt;fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump&#39;s NULL check and its copy, resulting in a use-after-free.</p> <p>Unpublish ha-&gt;fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha-&gt;fce == NULL and skips it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump</p> <p>qla2x00_free_fce_trace() freed and cleared ha-&gt;fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha-&gt;fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump&#39;s NULL check and its copy, resulting in a use-after-free.</p> <p>Unpublish ha-&gt;fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha-&gt;fce == NULL and skips it.</p> https://vulnerability.circl.lu/vuln/cve-2026-89853