EUVD-2026-80448
GHSA-c5f6-cp2c-vcqc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local teardown race, not network-reachable (AV:L); narrow timing window (AC:H); requires ability to induce qpair deletion (PR:L); UAF corrupts freed kernel memory (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
qla2xxx_delete_qpair() deletes the request queue before the response queue. qla25xx_delete_req_que() frees the request queue memory (kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is only released later, in qla25xx_free_rsp_que(). In that window the response interrupt can still fire, qla2xxx_msix_rsp_q() queues qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue() dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path), a use-after-free.
The cancel_work_sync() added for the qpair teardown lives in the response free path, which runs after the request queue is already freed, so it does not protect rsp->req.
Release the response-queue interrupt and flush qpair->q_work before deleting the request queue, so no late completion can reach the freed request queue. Clearing have_irq makes the subsequent qla25xx_free_rsp_que() skip its free_irq(), and the firmware queue-delete order (request then response) is preserved; the request-delete mailbox completes on the default vector and is unaffected by dropping the qpair response interrupt early.
AnalysisAI
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel SCSI driver lets a local user who can trigger queue-pair teardown reach freed request-queue memory through a late response-queue interrupt. On hosts with a QLogic FC HBA using MSI-X multiqueue qpairs, qla2xxx_delete_qpair() frees the request queue via qla25xx_free_req_que() before the response-queue IRQ is released in qla25xx_free_rsp_que(), so a response interrupt firing in that window causes qla2xxx_msix_rsp_q() to queue qpair->q_work and qla_do_work() -> qla24xx_process_response_queue() to dereference the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a host running the Linux kernel qla2xxx driver with a QLogic Fibre Channel HBA present and using multiqueue qpairs (MSI-X response queues). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-416 use-after-free in the Linux kernel qla2xxx SCSI driver's qpair teardown path, not the information disclosure the 'Information Disclosure' tag implies - it is full-triad memory corruption (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.6.157, 6.12.110, 6.18.51, or 7.2.5 depending on your stable branch, or to 7.3-rc1 (or later) on mainline; the upstream fix commits are 7ac5be2a8609679fc6bbfea881360444a5ce8202, 1486cc18be3e2b4c2a730f4a1b0448d009381b3d, 10e9f05f7fd0a103886a867ec8afe621fe4b906a, 157ca7d1af45f87aa14a286754f19c3f72386988, and 505753ec2594c6af09a601f0dd60be7d840c1d2d, with advisory detail at https://nvd.nist.gov/vuln/detail/CVE-2026-89848. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux hosts with QLogic Fibre Channel HBAs and MSI-X multiqueue qpairs enabled, confirm whether kernel versions are affected per the vendor advisory for CVE-2026-89848, and apply the vendor-released kernel patch or schedule emergency maintenance for the highest-criticality storage servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today