GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89854 (GCVE-0-2026-89854)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free. Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 8c1ebcade6aac58137f2645b579894301febabf3 (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 1d8bbc4344b9367d9d54731475d745fbc9ea28f2 (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 2c3b17ee53f034936f7398dbf4d143e608b7c35c (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < ae09260be7454ed7630a913f147591a25e3a9d09 (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < fcf0804dfe05862007189ac9dc4dc2063be36de1 (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 8286a9095fb59751fba171afa2b4f590271c87d5 (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 122bf170c94a3797531b12fee580639a5dc893ed (git)
Affected: fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 , < 33d102102d925357c5fd172dd6672a27d74b3215 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c1ebcade6aac58137f2645b579894301febabf3",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "1d8bbc4344b9367d9d54731475d745fbc9ea28f2",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "2c3b17ee53f034936f7398dbf4d143e608b7c35c",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "ae09260be7454ed7630a913f147591a25e3a9d09",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "fcf0804dfe05862007189ac9dc4dc2063be36de1",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "8286a9095fb59751fba171afa2b4f590271c87d5",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "122bf170c94a3797531b12fee580639a5dc893ed",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            },
            {
              "lessThan": "33d102102d925357c5fd172dd6672a27d74b3215",
              "status": "affected",
              "version": "fe1b806f4f7172b1eae18ddeebb7d8fb351043f7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix cs84xx use-after-free on host teardown\n\nqla84xx_put_chip() drops the last reference to ha-\u003ecs84xx and frees it via\n__qla84xx_chip_release() without clearing ha-\u003ecs84xx. During teardown it ran\nbefore scsi_remove_host(), which is what removes the 84xx_fw_version host\nsysfs attribute. A concurrent read of that attribute in the window between\nthe two calls executes qla24xx_84xx_fw_version_show(), which dereferences\nthe freed ha-\u003ecs84xx, resulting in a use-after-free.\n\nMove qla84xx_put_chip() to after scsi_remove_host() in both\nqla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once\nscsi_remove_host() returns, the sysfs attribute is gone and kernfs has\ndrained any in-flight show(), so no reader can touch cs84xx; the put still\nruns before the host and ha are freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached from qla24xx_84xx_fw_version_show() on the SCSI host sysfs attribute while qla2x00_remove_one() tears down a QLogic ISP8432 (84xx) HBA. That is a local sysfs/PCI-unbind path, not a network or Fibre Channel frame handler.\nAC:L - An attacker can loop-read /sys/class/scsi_host/hostN/84xx_fw_version while teardown runs. qla84xx_put_chip() freed cs84xx before scsi_remove_host(), leaving a large window through timer stop, DMA free, workqueue destroy, and fc_remove_host(). The attacker controls the sysfs side and can retry.\nPR:L - 84xx_fw_version is DEVICE_ATTR(..., S_IRUGO) with no capable() check in qla24xx_84xx_fw_version_show(), so an unprivileged local user can read it. Per CNA driver-removal UAF precedent, concurrent PCI unbind or rmmod does not require the attacker to hold init-namespace root.\nUI:N - The attacker performs their own sysfs reads against 84xx_fw_version and can race routine driver unbind, rmmod, or PCI hot-remove. No separate victim action such as mounting a filesystem or confirming a prompt is required.\nS:U - The use-after-free corrupts the host kernel heap object qla_chip_state_84xx within the same kernel security authority. It is not a VM escape, IOMMU/DMA isolation bypass, or sandbox breakout.\nC:H - qla84xx_put_chip() kfree()s ha-\u003ecs84xx without clearing the pointer; a concurrent show() dereferences ha-\u003ecs84xx-\u003eop_fw_version. This kernel heap UAF lets a reused object be read, enabling arbitrary kernel information disclosure.\nI:H - If the reused object\u0027s op_fw_version is zero, show() calls qla84xx_verify_chip(), which takes ha-\u003ecs84xx-\u003eaccess_lock and writes op_fw_version on the freed object. Heap spraying that UAF yields arbitrary write and control-flow hijack primitives.\nA:H - Dereferencing the freed cs84xx pointer from sysfs context oopses or panics the kernel even when the UAF is not fully converted into a read/write primitive, so availability impact is complete."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:19.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215"
        }
      ],
      "title": "scsi: qla2xxx: Fix cs84xx use-after-free on host teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89854",
    "datePublished": "2026-09-16T10:31:27.906Z",
    "dateReserved": "2026-09-11T19:38:34.770Z",
    "dateUpdated": "2026-09-16T14:39:19.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:16:42.000Z",
      "cve": "CVE-2026-89854",
      "id": "msrc_CVE-2026-89854",
      "initial_release_date": "2026-09-17T01:16:42.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Fix cs84xx use-after-free on host teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89854.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89854\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:16:53.180\",\"lastModified\":\"2026-09-16T15:18:13.367\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix cs84xx use-after-free on host teardown\\n\\nqla84xx_put_chip() drops the last reference to ha-\u003ecs84xx and frees it via\\n__qla84xx_chip_release() without clearing ha-\u003ecs84xx. During teardown it ran\\nbefore scsi_remove_host(), which is what removes the 84xx_fw_version host\\nsysfs attribute. A concurrent read of that attribute in the window between\\nthe two calls executes qla24xx_84xx_fw_version_show(), which dereferences\\nthe freed ha-\u003ecs84xx, resulting in a use-after-free.\\n\\nMove qla84xx_put_chip() to after scsi_remove_host() in both\\nqla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once\\nscsi_remove_host() returns, the sysfs attribute is gone and kernfs has\\ndrained any in-flight show(), so no reader can touch cs84xx; the put still\\nruns before the host and ha are freed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"8c1ebcade6aac58137f2645b579894301febabf3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"1d8bbc4344b9367d9d54731475d745fbc9ea28f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"2c3b17ee53f034936f7398dbf4d143e608b7c35c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"ae09260be7454ed7630a913f147591a25e3a9d09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"fcf0804dfe05862007189ac9dc4dc2063be36de1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"8286a9095fb59751fba171afa2b4f590271c87d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"122bf170c94a3797531b12fee580639a5dc893ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1b806f4f7172b1eae18ddeebb7d8fb351043f7\",\"lessThan\":\"33d102102d925357c5fd172dd6672a27d74b3215\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.