CVE-2026-89853

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A use-after-free vulnerability occurs due to a race condition between freeing the FCE trace buffer and its use during a firmware dump. A local attacker could potentially exploit this by disabling the debugfs FCE trace, leading to system instability or a denial of service (DoS).

A use-after-free race exists in the qla2xxx FCE trace handling path. qla2x00_free_fce_trace() could free the FCE DMA buffer while firmware dump consumers such as qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() were checking and copying the same buffer under a different lock. A local actor able to disable FCE tracing through debugfs or otherwise control adapter diagnostic state could race this with a firmware dump and trigger a kernel crash or stale memory copy. For the CVSS the PR:L value is used in the paranoid score because some deployments may delegate debugfs or adapter control to reduced capability root or service accounts, although typical systems restrict it to administrators. The issue is not directly network reachable and requires local control plane interaction with the qla2xxx driver. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact because the bug class is a UAF around a freed DMA buffer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.