High 8.8Published Sep 16, 2026

CVE-2026-89849scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

Updated under an hour ago (2026-10-19 06:25 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from dd30706e73b70d67e88fdaca688db7a3374fd5de before 9204fb0888374083be74f799049649a17eab4191; from dd30706e73b70d67e88fdaca688db7a3374fd5de before b7418198b45b327194b97f856fe8ea8daa91f3fd; from dd30706e73b70d67e88fdaca688db7a3374fd5de before 8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6; from dd30706e73b70d67e88fdaca688db7a3374fd5de before e38041b47c29316ba79b645e2ae0b713d216b1db; from dd30706e73b70d67e88fdaca688db7a3374fd5de before e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805; from dd30706e73b70d67e88fdaca688db7a3374fd5de before 29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9; from dd30706e73b70d67e88fdaca688db7a3374fd5de before 0f41d07d72f2245208c45374ca8d0a1846cad667	CNA record

References

https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191
https://git.kernel.org/stable/c/b7418198b45b327194b97f856fe8ea8daa91f3fd
https://git.kernel.org/stable/c/8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6
https://git.kernel.org/stable/c/e38041b47c29316ba79b645e2ae0b713d216b1db
https://git.kernel.org/stable/c/e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805
https://git.kernel.org/stable/c/29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9
https://git.kernel.org/stable/c/0f41d07d72f2245208c45374ca8d0a1846cad667

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.