GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89857 (GCVE-0-2026-89857)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qla_nvme_ls_reject_iocb() allocates from and advances the request ring through __qla2x00_alloc_iocbs() (which assumes the hardware_lock is held) and qla2x00_start_iocbs() (which advances the ring and rings the request-in doorbell), but takes no lock itself. Two of its callers invoke it without the producer lock held: - qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on its error path, and - qla2xxx_process_purls_pkt(), run from the purex work/DPC context. Both use ha->base_qpair, whose qp_lock_ptr is hardware_lock, so they can run concurrently with normal I/O submission on the base ring and corrupt the ring producer state, leading to duplicated or dropped commands. The third caller, qla2xxx_process_purls_iocb(), runs inside qla24xx_process_response_queue() with the qpair lock already held and is safe; that is also why the lock cannot be taken inside the helper itself (it would recursively re-acquire hardware_lock on the response path). Take qp_lock_ptr around the two unlocked callers and document the helper as caller-locked. Both run in process context, so spin_lock_irqsave() is used and nothing in the locked region sleeps.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 7eb618877503edbf17aa65e357a81bda1fc8f163 (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < b3a362466db6b8ec47cc537ac641ac197fa69b5d (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 11834e5773e20fd3742d7eb900876e66b9e7d029 (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < b02ff132017b28222187ebcf95ce7f4cb576cd36 (git)
Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < f743488e4a203049f27ec5d8cd0caccc483af01e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7eb618877503edbf17aa65e357a81bda1fc8f163",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "b3a362466db6b8ec47cc537ac641ac197fa69b5d",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "11834e5773e20fd3742d7eb900876e66b9e7d029",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "b02ff132017b28222187ebcf95ce7f4cb576cd36",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "f743488e4a203049f27ec5d8cd0caccc483af01e",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold qpair lock when sending NVMe LS reject\n\nqla_nvme_ls_reject_iocb() allocates from and advances the request ring\nthrough __qla2x00_alloc_iocbs() (which assumes the hardware_lock is\nheld) and qla2x00_start_iocbs() (which advances the ring and rings the\nrequest-in doorbell), but takes no lock itself. Two of its callers\ninvoke it without the producer lock held:\n\n - qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on\n   its error path, and\n\n - qla2xxx_process_purls_pkt(), run from the purex work/DPC context.\n\nBoth use ha-\u003ebase_qpair, whose qp_lock_ptr is hardware_lock, so they can\nrun concurrently with normal I/O submission on the base ring and corrupt\nthe ring producer state, leading to duplicated or dropped commands. The\nthird caller, qla2xxx_process_purls_iocb(), runs inside\nqla24xx_process_response_queue() with the qpair lock already held and is\nsafe; that is also why the lock cannot be taken inside the helper itself\n(it would recursively re-acquire hardware_lock on the response path).\n\nTake qp_lock_ptr around the two unlocked callers and document the helper\nas caller-locked. Both run in process context, so spin_lock_irqsave() is\nused and nothing in the locked region sleeps."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Unsolicited NVMe-FC LS frames are posted as PT_LS4_UNSOL and reach qla2xxx_process_purls_pkt and qla_nvme_xmt_ls_rsp from a remote SAN peer. QLogic CNAs speak FCoE and fabrics are stretched via FCIP/inter-fabric routing, so a compromised target delivers those frames over the storage network with no local syscall.\nAC:L - A malicious NVMe-FC peer drives both base_qpair producers: LS that fail nvme_fc_rcv_ls_req or xmt_ls_rsp take unlocked qla_nvme_ls_reject_iocb, while concurrent accepted LS (or host NVMe LS/ELS via qla2x00_start_sp on the same qpair from qla2x00_get_sp) take the locked path. The attacker can flood and retry those frames.\nPR:N - Unsolicited NVMe-FC Link Service frames are handled from a logged-in fabric N_Port with no Linux user, capability, or authentication check on the LS-reject path. FC-SP/EDIF is opt-in; zoning is network access, not privileges on the victim host.\nUI:N - The HBA response-queue interrupt, DPC PROCESS_PUREX_IOCB path, and nvme_fc workqueue process unsolicited LS and emit the reject IOCB automatically; no victim mount, open, or other interactive action is required.\nS:U - Request-ring producer corruption and any resulting kernel or adapter failure stay inside the host kernel that owns the qla2xxx driver and do not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - Unlocked __qla2x00_alloc_iocbs/qla2x00_start_iocbs racing a locked producer can overwrite one ring slot and doorbell an extra stale slot. Firmware then DMA-executes leftover IOCBs whose addresses and handles may already have been recycled, a use-after-free/DMA-confusion read of kernel or I/O buffers.\nI:H - The same stale-slot replay and double-doorbell let firmware rewrite recycled DMA buffers or complete the wrong outstanding_cmds handle, including a second scsi_done/sp-\u003edone on a reused SRB, which is a kernel write and control-flow hijack primitive rather than only dropped I/O.\nA:H - Corrupted request-ring producer state duplicates or drops commands as the fix describes, desynchronizes firmware completions, and can oops on a bad handle or hang NVMe/SCSI I/O, taking down storage served by the adapter."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:21.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7eb618877503edbf17aa65e357a81bda1fc8f163"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3a362466db6b8ec47cc537ac641ac197fa69b5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/11834e5773e20fd3742d7eb900876e66b9e7d029"
        },
        {
          "url": "https://git.kernel.org/stable/c/b02ff132017b28222187ebcf95ce7f4cb576cd36"
        },
        {
          "url": "https://git.kernel.org/stable/c/f743488e4a203049f27ec5d8cd0caccc483af01e"
        }
      ],
      "title": "scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89857",
    "datePublished": "2026-09-16T10:31:30.193Z",
    "dateReserved": "2026-09-11T19:38:34.771Z",
    "dateUpdated": "2026-09-16T14:39:21.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89857",
      "date": "2026-09-17",
      "epss": "0.00618",
      "percentile": "0.48046"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89857\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:16:53.573\",\"lastModified\":\"2026-09-16T15:18:13.657\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Hold qpair lock when sending NVMe LS reject\\n\\nqla_nvme_ls_reject_iocb() allocates from and advances the request ring\\nthrough __qla2x00_alloc_iocbs() (which assumes the hardware_lock is\\nheld) and qla2x00_start_iocbs() (which advances the ring and rings the\\nrequest-in doorbell), but takes no lock itself. Two of its callers\\ninvoke it without the producer lock held:\\n\\n - qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on\\n   its error path, and\\n\\n - qla2xxx_process_purls_pkt(), run from the purex work/DPC context.\\n\\nBoth use ha-\u003ebase_qpair, whose qp_lock_ptr is hardware_lock, so they can\\nrun concurrently with normal I/O submission on the base ring and corrupt\\nthe ring producer state, leading to duplicated or dropped commands. The\\nthird caller, qla2xxx_process_purls_iocb(), runs inside\\nqla24xx_process_response_queue() with the qpair lock already held and is\\nsafe; that is also why the lock cannot be taken inside the helper itself\\n(it would recursively re-acquire hardware_lock on the response path).\\n\\nTake qp_lock_ptr around the two unlocked callers and document the helper\\nas caller-locked. Both run in process context, so spin_lock_irqsave() is\\nused and nothing in the locked region sleeps.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_nvme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"875386b98857822b77ac7f95bdf367b70af5b78c\",\"lessThan\":\"7eb618877503edbf17aa65e357a81bda1fc8f163\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"875386b98857822b77ac7f95bdf367b70af5b78c\",\"lessThan\":\"b3a362466db6b8ec47cc537ac641ac197fa69b5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"875386b98857822b77ac7f95bdf367b70af5b78c\",\"lessThan\":\"11834e5773e20fd3742d7eb900876e66b9e7d029\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"875386b98857822b77ac7f95bdf367b70af5b78c\",\"lessThan\":\"b02ff132017b28222187ebcf95ce7f4cb576cd36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"875386b98857822b77ac7f95bdf367b70af5b78c\",\"lessThan\":\"f743488e4a203049f27ec5d8cd0caccc483af01e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_nvme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11834e5773e20fd3742d7eb900876e66b9e7d029\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7eb618877503edbf17aa65e357a81bda1fc8f163\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b02ff132017b28222187ebcf95ce7f4cb576cd36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b3a362466db6b8ec47cc537ac641ac197fa69b5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f743488e4a203049f27ec5d8cd0caccc483af01e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.