CVE-2026-89848

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs during the process of deleting a storage device's queue, where memory is released prematurely while the system can still attempt to access it. This timing issue, known as a use-after-free, could allow a local attacker to trigger a system crash. The most significant impact of this flaw is a denial of service, making the system unavailable.

A use-after-free race in the qla2xxx teardown path can occur because qla2xxx_delete_qpair deletes the request queue before the response queue IRQ is quiesced. During this window a late response MSI-X interrupt can queue qpair q_work, and qla_do_work can process the response queue while rsp req still points to request queue memory that has already been freed. For the CVSS the PR:N is used for the paranoid network adjacent scenario because an attacker that controls or impersonates a Fibre Channel peer may not need a local account on the host, although reliable triggering still depends on hitting the teardown or reset timing window. The issue is not reachable from ordinary IP networks and normally applies to hosts with affected QLogic Fibre Channel hardware and an exposed or attacker influenced storage fabric. Impact is at least denial of service via kernel crash and in worst case may allow broader confidentiality or integrity impact due to kernel use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.