CVE-2026-89860

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when an abort operation is initiated multiple times for the same command, leading to a race condition. During this race, a work item can be reinitialized while it is still active in the kernel's processing queue. This corruption of the internal workqueue list can result in system instability, including crashes or a continuously looping process, thereby causing a Denial of Service (DoS).

A race in the qla2xxx FC-NVMe abort path can reinitialize priv abort_work with INIT_WORK() while the same work_struct is already queued. A repeated abort for the same command, for example from concurrent transport teardown and a timeout driven abort, can reset workqueue state and corrupt the workqueue list. This can lead to a kernel crash or a looping worker, so the base impact is denial of service. For the CVSS the PR:N is used for the paranoid storage fabric scenario because an attacker controlling or disrupting the FC-NVMe target or fabric may trigger repeated abort conditions without a local account on the host. The issue is adjacent network reachable through the storage fabric rather than reachable over the public Internet. Impact is at least availability loss and in worst case may allow limited confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.