Is there a patch available for CVE-2026-89862?

Yes, a patch is available for CVE-2026-89862. Update the affected software to the latest version immediately.

Linux CVE-2026-89862

EUVD-2026-80462

2026-09-16 Linux

GHSA-pqg5-73mw-qfjw

Information Disclosure Linux

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix BSG job leak on validate flash image error path

qla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally, telling the FC BSG transport (fc_bsg_host_dispatch()) that the driver owns and will complete the request. But bsg_job_done() is guarded by "if (!rval)", so on the error path (rval == -EINVAL) neither the driver nor the transport completes the job. The request dangles until it times out, leaking block layer resources.

Commit c2c68225b145 ("scsi: qla2xxx: Fix bsg_done() causing double free") added the "if (!rval)" guard to a batch of BSG handlers. That is correct for handlers that also return the error code (the transport then completes the job once via fail_host_msg), but this function returns QLA_SUCCESS unconditionally, so the guard turned a correct single completion into a leak.

Always call bsg_job_done(): bsg_reply->result is DID_OK and the error is reported in vendor_rsp[0], and since the function returns 0 the transport will not complete the job a second time.

Affected VersionsENISA

Linux 871f6236da96c4a9712b8a29d7f555f767a47e95

Linux 6.1.164 <6.2

Linux 708003e1bc857dd014d4c44278d7d77c26f91b1c

Linux c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 <0fb52cc632464b0cd07f970341330466d772efe1

Linux 74e7458537cd9349cf019862e51491f670871707

Linux c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 <e25241f9fa01fb0c088381a156d84a725b71c1ef

Linux 7.0

Linux 31f33b856d2324d86bcaef295f4d210477a1c018

Linux patch: 0

Linux 5.15.201 <5.16

Linux f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720

Linux 5.10.251 <5.11

Linux patch: 7.2.5

Linux 6.12.74 <6.13

Linux 27ac9679c43a09e54e2d9aae9980ada045b428e0

Linux 6.18.13 <6.19

Linux patch: 7.3-rc1

Linux 6.6.127 <6.7

Linux 6.19.3 <6.20

Linux 057a5bdc481e58ab853117254867ffb22caf9f6e

Affected Packages

euvd linux fix: 5.11, 5.16, 6.2, 6.7, 6.13, 6.19, 6.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:31 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.