CVE-2026-89857

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs because a specific function responsible for sending NVMe Local-Scope (LS) rejects does not properly acquire a necessary lock. This oversight allows for concurrent operations, which can corrupt the internal state of the I/O request ring. As a result, input/output commands may be duplicated or dropped, potentially leading to data integrity issues or system instability.

A race condition in the qla2xxx NVMe FC path can occur because qla_nvme_ls_reject_iocb allocates from and advances the request ring without taking the qpair producer lock in two caller paths. Concurrent execution with normal I/O submission on the base request ring can corrupt the ring producer state and may lead to duplicated or dropped commands. For the CVSS the PR:N is used for the paranoid score because an attacker with access to the same Fibre Channel or NVMe FC fabric may not need a local account on the victim host. The issue is adjacent network reachable rather than Internet reachable, because practical triggering requires access to the storage fabric where the affected adapter and NVMe FC traffic are present. Impact includes denial of service and potential storage I/O integrity impact due to lost or duplicated commands.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.