CVE-2026-89845scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before c845f2597787ef70159a32566669e308b2807a56; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before fe04b31e386aee4cc3a18f07462af146037dc389; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before 1b995cf4157465357d66ba096e7cdaafab9972e7; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before d79376fbd2a076de82c1cd8aa0b600b300c75a44; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before 1c90b74e484ba48f31944fe04963d99e01ac3767; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before 5dd9bec8004ba93cee8b689bf54ce294f59e5e3c; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before 35124cfa9898b2088ee72859e573e0876aff66fc; from a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b before deb8abde83a799d2501f3977f6d6051000253f5e | CNA record |
References
- https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56
- https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389
- https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7
- https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44
- https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767
- https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
- https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc
- https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.