Skip to main content

Linux Kernel EUVDEUVD-2026-80444

| CVE-2026-89844 HIGH
2026-09-16 Linux GHSA-8hj3-p94r-f47v
Denial Of Service Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.0 LOW

Local config-dependent NPIV race (AV:L, AC:H, PR:H); no confidentiality (C:N); bounded kernel btree corruption gives low integrity/availability impact (I:L/A:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Metadata Corrected
Sep 16, 2026 - 15:40 vuln.today
tag: Denial Of Service added
Metadata Corrected
Sep 16, 2026 - 15:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 16, 2026 - 15:38 vuln.today
CVSS changed
Sep 16, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Sep 16, 2026 - 11:03 EUVD
CVE Published
Sep 16, 2026 - 10:31 cve.org
HIGH 8.8
CVE Published
Sep 16, 2026 - 10:31 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

qla24xx_report_id_acquisition() format-1 handling drops vport_slock after taking the vport reference and then calls qla_update_host_map() without the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32()/btree_update32()/btree_remove32() and is documented to require vport_slock to be held by the caller. Running it unlocked can race concurrent host_map updates and corrupt the btree.

The format-2 path in the same function already wraps its host_map update (SET_AL_PA) in vport_slock; the format-1 path is the lone outlier.

Hold vport_slock across the format-1 qla_update_host_map() call to honor the documented locking contract. The vref_count taken in the loop keeps the vport valid, so this only adds the missing host_map serialization.

AnalysisAI

Concurrent host_map btree corruption can occur in the Linux kernel's qla2xxx QLogic Fibre Channel driver because the format-1 branch of qla24xx_report_id_acquisition() releases vport_slock before invoking qla_update_host_map()/qla_update_vp_map(), which mutates ha->host_map without the serialization the function contract requires. Only systems running the qla2xxx driver with a QLogic FC HBA and NPIV virtual ports configured (a privileged local configuration) exercise this code path, and triggering it depends on winning a narrow, non-deterministic timing race against another host_map update. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a system running the Linux qla2xxx driver with a QLogic Fibre Channel HBA, with NPIV virtual ports in use so the format-1 path of qla24xx_report_id_acquisition() is exercised. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is severely miscalibrated for what the patch actually describes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor patch by upgrading to a kernel that contains the fix - upstream stable releases 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (the change also appears in 7.3-rc1) - or cherry-pick the relevant upstream commit listed in the references (https://git.kernel.org/stable/c/6ed66e2a67bbd22877008ff9aa64bd574a7fc011, .../7944039ba9cb5c3a935d17c91004e3b8649ff58e, .../e8f1b0cb9782338c6341ceed816e9c1243743cdd, .../7d0b3f745efb24c0aac5e06b49b3420bc65d23b9, .../776e4e8cbcf155302f430ce9793d1502e3c113a0); no separate vendor advisory URL beyond the NVD/EUVD records was provided. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Linux servers with QLogic Fibre Channel HBAs and NPIV virtual ports enabled, and apply the vendor-released patch for CVE-2026-89844 (Patch available per vendor advisory); if patching is not immediately possible, restrict local privileged access and monitor system logs for kernel panics or corruption indicators. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-80444 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy