CVE-2026-89844

A flaw was found in the Linux kernel's qla2xxx SCSI driver. The qla24xx_report_id_acquisition() function does not properly hold a lock (vport_slock) when updating the host map btree. This oversight creates a race condition, allowing multiple concurrent updates to the host map. An attacker could exploit this to corrupt the btree, potentially leading to system instability or a denial of service (DoS).

qla2xxx report ID acquisition can update the host_map btree without holding vport_slock in the format 1 path, while the same map is also modified by other serialized paths. Concurrent btree_insert32, btree_update32, or btree_remove32 operations can race and corrupt the host_map data structure. For the CVSS the PR:N is used for the paranoid adjacent fabric scenario because an attacker may not need local code execution on the victim if they can influence Fibre Channel fabric events, but practical exploitation usually requires access to the same FC SAN or control of storage fabric behavior. The issue is not directly Internet reachable over TCP/IP by itself. Impact is at least denial of service through kernel crash or storage path disruption, and in worst case may allow limited confidentiality or integrity impact due to kernel data structure corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.