CVE-2026-89861

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs in the qla24xx_report_id_acquisition() function where a virtual port reference is not properly maintained. A local attacker could exploit this timing issue, allowing a concurrent operation to free the virtual port prematurely, leading to a use-after-free condition. This could result in system instability, crashes, or potentially lead to arbitrary code execution.

A race in qla24xx_report_id_acquisition can leave a qla2xxx virtual port pointer unprotected after it is found on ha vp_list. A concurrent qla24xx_deallocate_vp_id can tear down and free the same vport before later code updates host mapping and sets flags through that stale pointer. This is a use after free in kernel driver state and can cause at least a local denial of service via crash. In the worst still defensible case, the stale pointer writes may allow broader memory corruption impact, so confidentiality and integrity are treated as high in the paranoid score. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate NPIV or storage administration to reduced capability root, container root, or service accounts rather than full host administrators. The issue is not directly reachable over normal IP networking, but Fibre Channel fabric events and SAN access may be relevant to triggering the vulnerable path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.