CVE-2026-89856

A flaw was found in the Linux kernel's scsi: qla2xxx component. A misconfigured or malicious hot-plugged device could provide specific Message Signaled Interrupts (MSI-X) vector counts, causing an internal queue count to become zero due to truncation. This leads to an attempt to access an invalid memory address, which can result in memory corruption or a system crash, causing a Denial of Service.

This vulnerability is rated as having a Moderate impact because triggering it requires the ability to attach or emulate a malicious Fibre Channel hardware device, restricting exploitation to attackers with local physical access or privileged virtualization capabilities. Systems that do not utilize QLogic Fibre Channel host bus adapters (HBAs) or do not allow untrusted PCIe hot-plugging are not exposed to this issue. When successfully exploited, the flaw results in a kernel crash, impacting system availability without directly enabling arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.