EUVD-2026-80444
GHSA-8hj3-p94r-f47v
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local config-dependent NPIV race (AV:L, AC:H, PR:H); no confidentiality (C:N); bounded kernel btree corruption gives low integrity/availability impact (I:L/A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
qla24xx_report_id_acquisition() format-1 handling drops vport_slock after taking the vport reference and then calls qla_update_host_map() without the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32()/btree_update32()/btree_remove32() and is documented to require vport_slock to be held by the caller. Running it unlocked can race concurrent host_map updates and corrupt the btree.
The format-2 path in the same function already wraps its host_map update (SET_AL_PA) in vport_slock; the format-1 path is the lone outlier.
Hold vport_slock across the format-1 qla_update_host_map() call to honor the documented locking contract. The vref_count taken in the loop keeps the vport valid, so this only adds the missing host_map serialization.
AnalysisAI
Concurrent host_map btree corruption can occur in the Linux kernel's qla2xxx QLogic Fibre Channel driver because the format-1 branch of qla24xx_report_id_acquisition() releases vport_slock before invoking qla_update_host_map()/qla_update_vp_map(), which mutates ha->host_map without the serialization the function contract requires. Only systems running the qla2xxx driver with a QLogic FC HBA and NPIV virtual ports configured (a privileged local configuration) exercise this code path, and triggering it depends on winning a narrow, non-deterministic timing race against another host_map update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a system running the Linux qla2xxx driver with a QLogic Fibre Channel HBA, with NPIV virtual ports in use so the format-1 path of qla24xx_report_id_acquisition() is exercised. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is severely miscalibrated for what the patch actually describes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch by upgrading to a kernel that contains the fix - upstream stable releases 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (the change also appears in 7.3-rc1) - or cherry-pick the relevant upstream commit listed in the references (https://git.kernel.org/stable/c/6ed66e2a67bbd22877008ff9aa64bd574a7fc011, .../7944039ba9cb5c3a935d17c91004e3b8649ff58e, .../e8f1b0cb9782338c6341ceed816e9c1243743cdd, .../7d0b3f745efb24c0aac5e06b49b3420bc65d23b9, .../776e4e8cbcf155302f430ce9793d1502e3c113a0); no separate vendor advisory URL beyond the NVD/EUVD records was provided. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux servers with QLogic Fibre Channel HBAs and NPIV virtual ports enabled, and apply the vendor-released patch for CVE-2026-89844 (Patch available per vendor advisory); if patching is not immediately possible, restrict local privileged access and monitor system logs for kernel panics or corruption indicators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today