CVE-2026-89849

A flaw was found in the Linux kernel's qla2xxx SCSI driver. When the firmware delivers an unexpected status input/output control block (IOCB) for a non-SCSI command, the driver can incorrectly process a garbage pointer. This wild pointer dereference can lead to system instability or a denial of service.

Red Hat has evaluated this vulnerability as having a Moderate severity because exploitation is restricted to denial of service and requires systems equipped with physical QLogic Fibre Channel storage hardware. The flaw is triggered when the underlying firmware delivers unexpected status control blocks for non-SCSI requests, resulting in an invalid pointer dereference that crashes the kernel. Systems without QLogic HBAs or where the qla2xxx driver is not loaded are not vulnerable to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.