CVE-2026-89854

A flaw was found in the kernel's qla2xxx SCSI driver. A use-after-free vulnerability exists due to a race condition during host teardown. When a host is being removed, the cs84xx object can be freed before its corresponding sysfs attribute is removed. A local attacker, by concurrently reading this attribute, can trigger a dereference of the freed memory, leading to system instability or a denial of service (DoS).

A use after free exists in the qla2xxx teardown path because ha cs84xx can be released before the 84xx_fw_version sysfs attribute is removed. A concurrent local read of qla24xx_84xx_fw_version_show() can dereference the freed object during the window between qla84xx_put_chip() and scsi_remove_host(), causing a kernel crash or exposing stale data from reused memory. For the CVSS the PR:L is used in the paranoid scenario because a local user may be able to read the host sysfs attribute while teardown is triggered by hotplug, PCI error handling, or an administrative management action. The issue is not network reachable and requires local interaction with sysfs plus a teardown race. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to use after free and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.