qla2xxx Driver CVE-2026-89849

Requires the host to run the qla2xxx driver with a physical QLogic Fibre Channel HBA present. Exploitation depends on the adapter firmware delivering an unexpected STATUS_TYPE completion IOCB that maps to a non-SCSI outstanding handle (e.g., one whose srb type is SRB_NVME_CMD, SRB_BIDI_CMD, SRB_TM_CMD, or another non-SCSI/IOCB layout) so that the overlaid sp->u.scmd.cmd reads as a non-NULL garbage pointer. This is not reachable from software configuration alone - it requires influence over adapter firmware behavior or the FC fabric, making it an adjacent/hardware-path condition rather than default remote exploitation. LIMITING factors: no network-facing service is involved; the attacker must be on the storage fabric or control firmware, the malformed IOCB must coincide with a live non-SCSI outstanding handle, and the practical outcome is a crash rather than reliable code execution.

This is a defensive hardening fix ('Reject non-SCSI SRB on status IOCB fast path') for a wild-pointer dereference in the QLogic qla2xxx Fibre Channel HBA driver, not a remotely weaponizable memory-corruption primitive. The vendor CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) substantially overstates real-world risk. The trigger is firmware delivering an *unexpected* STATUS_TYPE IOCB for a non-SCSI handle so that sp->u.scmd.cmd reads as non-NULL garbage from an overlaid srb union - this is a firmware/host-side condition, not a clean packet-level network attack. AC:L is wrong: producing an out-of-spec IOCB that lands on a non-SCSI handle is an unusual, hard-to-steer condition (AC:H). C:H/I:H are dubious for a wild-pointer dereference whose most likely outcome is a kernel panic/crash (A:H), with confidentiality/integrity impact incidental at best. No EPSS score, no CISA KEV listing, and no public PoC are present, consistent with an obscure, hardware-triggered kernel bug rather than an exploited one. Net: no public exploit identified at time of analysis; realistic priority is low-to-moderate and confined to environments running QLogic FC HBAs, with malfunctioning firmware being at least as likely a trigger as a deliberate attacker.

A malicious or malfunctioning Fibre Channel fabric/target (or compromised HBA firmware) causes the adapter to deliver an unexpected STATUS_TYPE completion IOCB referencing a non-SCSI outstanding handle. The kernel's qla2x00_status_entry() falls through to the SCSI fast path, reads a garbage command pointer from the overlaid srb union, and dereferences it, most likely crashing the host. No public exploit code is identified at time of analysis.