EUVD-2026-80447
GHSA-6f8q-4cvp-fr9q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local kernel-internal race on FC control path (AV:L, AC:H) needing driver access (PR:L); impact is mainly a UAF crash (A:H) with bounded corruption (C:L/I:L), not the vendor's network C:H/I:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid double completion in async IOCB timeout
qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When qla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the SRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then call sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking whether the SRB was actually found and removed.
If the response ISR completes the same handle first, it removes the SRB under qp_lock_ptr and runs sp->done() -> complete(sp->comp). The submitter qla24xx_control_vp() wakes from wait_for_completion(), clears sp->comp, drops its reference and returns, reclaiming the on-stack completion. The timer reference keeps the SRB alive across the timeout handler, but not the submitter's stack. The timeout then issues a second sp->done() -> qla_ctrlvp_sp_done(), which evaluates "if (sp->comp) complete(sp->comp)"; with the pointer loaded before the submitter's NULL store, complete() writes into the freed stack frame, a use-after-free.
Track whether this path removed the SRB from outstanding_cmds and only call sp->done() when it did, so the command is completed exactly once by whichever path owns it. This mirrors the sp_found guard already used in qla24xx_abort_iocb_timeout().
AnalysisAI
A double-completion race in the Linux kernel's qla2xxx QLogic Fibre Channel driver can cause a use-after-free write into a freed on-stack completion structure, leading to kernel memory corruption, a kernel crash, or potential local privilege escalation. Only hosts with a QLogic FC HBA and the qla2xxx driver loaded are affected, and the fault requires qla24xx_async_abort_cmd() to fail while the response ISR completes the same SRB handle at almost the same instant the async IOCB timeout handler re-scans outstanding_cmds[], so the attacker must win a very narrow concurrency window - local access only and no network reachability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a host with a QLogic Fibre Channel HBA and the qla2xxx driver loaded (enterprise SAN/FC storage servers), plus triggering an async IOCB timeout on the SRB_LOGIN_CMD or SRB_CTRL_VP/default path where qla24xx_async_abort_cmd() fails. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor/NVD CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is wildly inconsistent with the actual vulnerability and should not drive prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading the kernel to a fixed stable release - 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 - or by cherry-picking the corresponding upstream commit (for example 71a7b6e3c7f121439f51a058e53d4a8e05b63dec or 7257b5e1fb6c9387714f66e01b79ec82b717eede) from git.kernel.org; distribution kernels that backport qla2xxx fixes should be updated per the vendor errata referenced at https://nvd.nist.gov/vuln/detail/CVE-2026-89847. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts with QLogic Fibre Channel HBAs and the qla2xxx driver loaded (lspci | grep -i qlogic, lsmod | grep qla2xxx) and confirm which kernel versions they run, prioritising SAN-attached production and backup systems; verify whether the NVD 9.8 score has been used to escalate this above other work, and correct that rating internally to reflect the assessed local, high-complexity, authenticated vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today