EUVD-2026-80461
GHSA-jp2p-cx4h-xhw3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local NPIV teardown race (AV:L), tight timing window (AC:H), requires vport-config privilege (PR:L); UAF is DoS-dominant (A:H) with only incidental C/I:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before vp is used: qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/ REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport down and free it, leading to a use-after-free.
Take a vport reference (vref_count) under vport_slock when the matching vp is found, and drop it after the last use of vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before unlinking and freeing the vport, so the pointer stays valid. This matches the reference idiom already used by the other ha->vp_list traversals.
AnalysisAI
A race condition in the Linux kernel's qla2xxx QLogic Fibre Channel driver allows a concurrent vport deallocation to free an NPIV virtual port while the format-1 report-ID-acquisition path still dereferences it, producing a use-after-free. The flaw is reachable only on systems that run a qla2xxx-driven QLogic FC HBA with NPIV virtual ports configured and that grant an attacker the local privilege needed to create and tear down virtual ports; the window is narrow (AC:H) and no attacker-controlled network input reaches the freed pointer, so the realistic outcome is a kernel crash or denial of service rather than controlled memory corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a QLogic Fibre Channel HBA driven by qla2xxx with NPIV virtual ports in use, and local privilege to create/tear down virtual ports (the qla24xx_deallocate_vp_id path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-362 race leading to a CWE-416 use-after-free in the qla2xxx QLogic Fibre Channel driver's NPIV virtual-port acquisition path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5 depending on your stable branch, or to mainline 7.3-rc1 or later; the upstream fix commits are linked from the vendor references at https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf, https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69, https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e, https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83, https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297, and https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb, with NVD detail at https://nvd.nist.gov/vuln/detail/CVE-2026-89861. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts with QLogic Fibre Channel HBAs using the qla2xxx driver and NPIV virtual ports enabled, and determine whether they run a kernel version listed as affected in your distribution vendor's advisory for CVE-2026-89861; if so, schedule immediate maintenance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today