CVE-2026-89863

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability, a NULL pointer dereference, occurs when the system attempts to process a SCSI command that has already been completed or aborted by the firmware. This can lead to a system crash, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate because exploitation is confined to a local denial of service via a kernel panic, without presenting a direct path to code execution or compromise of data integrity and confidentiality. Exposure is strictly limited to enterprise environments running systems equipped with QLogic Fibre Channel host bus adapters utilizing the qla2xxx driver. Systems lacking this specific storage hardware or where the driver module is not loaded are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.