EUVD-2026-80454
GHSA-9v3f-qp8w-f486
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and a narrow teardown race drive AV:L/AC:H; low-priv sysfs read gives PR:L; read-only UAF yields bounded C:L, no integrity, and A:L crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.
Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
AnalysisAI
A use-after-free read in the Linux kernel's qla2xxx SCSI driver allows a local low-privilege (authenticated) user on a host with a QLogic cs84xx-capable Fibre Channel HBA to dereference freed memory by reading the 84xx_fw_version sysfs attribute while the adapter is being torn down. The race is bounded to the teardown window between qla84xx_put_chip() freeing ha->cs84xx and scsi_remove_host() draining the sysfs show handler, and since the dereference in qla24xx_84xx_fw_version_show() is read-only the realistic impact is an information leak or kernel crash rather than controlled corruption, meaning the vendor CVSS of 7.8 overstates real risk for this narrow, hardware-dependent timing bug. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a system with a QLogic cs84xx-capable Fibre Channel HBA driven by qla2xxx (ha->cs84xx must be allocated), and the ability to read the 84xx_fw_version sysfs attribute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk for what is a narrow, read-based use-after-free in the qla2xxx SCSI driver. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to a fixed stable kernel: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5/7.3-rc1, or cherry-pick the relevant mainline/stable commit for your branch (see the git.kernel.org stable commit links referenced under CVE-2026-89854 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-89854). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux servers with QLogic cs84xx-capable Fibre Channel HBAs and restrict local shell access to trusted administrators; monitor for kernel crashes or unexpected reboots on those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today