CVE-2026-89842

A flaw was found in the Linux kernel's qla2xxx SCSI driver. Under certain conditions, specifically when the firmware is not fully initialized or is in a reset state, the driver attempts to communicate with it. This can cause the system to try and process an invalid command, leading to instability or a system crash. This issue could result in a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because it requires systems equipped with specific QLogic Fibre Channel host bus adapters operating in NVMe-over-Fabrics mode, and its blast radius is restricted to a local denial of service. The failure occurs only during adapter recovery or initialization windows when the firmware is inactive or undergoing reset. Standard installations without this specialized storage hardware or without active NVMe-FC configurations are unaffected by this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.