EUVD-2026-80449
GHSA-3v4r-7crj-gvc7
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trigger comes from the FC fabric/adapter firmware (AV:A) and requires an unusual, hard-to-steer malformed IOCB coinciding with a non-SCSI handle (AC:H); impact is a wild-pointer crash (A:H) with only incidental C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference.
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
AnalysisAI
Wild-pointer dereference in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets an unexpected STATUS_TYPE completion IOCB reach a SCSI-only fast path, where the srb union is reinterpreted so sp->u.scmd.cmd reads as a non-NULL garbage pointer and is dereferenced. Only hosts running the qla2xxx driver with a physical QLogic FC HBA are exposed, and only when the adapter firmware or FC fabric delivers a mis-typed status IOCB that coincides with a live non-SCSI outstanding handle; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, so the realistic outcome is a kernel crash rather than reliable code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the host to run the qla2xxx driver with a physical QLogic Fibre Channel HBA present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a defensive hardening fix ('Reject non-SCSI SRB on status IOCB fast path') for a wild-pointer dereference in the QLogic qla2xxx Fibre Channel HBA driver, not a remotely weaponizable memory-corruption primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patch: upgrade to Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 (or later), or cherry-pick the upstream fix commit dd30706e73b70d67e88fdaca688db7a3374fd5de / the matching stable backports listed in the references at https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191 and the other git.kernel.org stable links, with the advisory mirrored at https://nvd.nist.gov/vuln/detail/CVE-2026-89849. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems equipped with QLogic Fibre Channel HBAs and confirm whether the qla2xxx driver is loaded; if emergency patching is not feasible, consider isolating affected hosts from untrusted FC fabrics or restricting fabric access to trusted devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today