{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89848 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89848 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89848 and fix it if it is affected.\n\nWhat it is: CVE-2026-89848 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89848 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89848/ (Markdown: https://insights.sbomify.com/CVE-2026-89848/index.md)","id":"CVE-2026-89848","markdown":"https://insights.sbomify.com/CVE-2026-89848/index.md","name":"CVE-2026-89848","record":{"aliases":["AZL-101286","BELL-CVE-2026-89848","DEBIAN-CVE-2026-89848","GHSA-c5f6-cp2c-vcqc","UBUNTU-CVE-2026-89848"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A use-after-free in the qla2xxx SCSI driver allows attackers to trigger memory corruption via race conditions during queue deletion, potentially leading to code execution or crashes.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Quiesce response IRQ before freeing request queue\n\nqla2xxx_delete_qpair() deletes the request queue before the response\nqueue. qla25xx_delete_req_que() frees the request queue memory\n(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is\nonly released later, in qla25xx_free_rsp_que(). In that window the\nresponse interrupt can still fire, qla2xxx_msix_rsp_q() queues\nqpair-\u003eq_work, and qla_do_work() -\u003e qla24xx_process_response_queue()\ndereferences the now-freed rsp-\u003ereq (LOGINOUT/CT/ELS entries and the\nstatus path), a use-after-free.\n\nThe cancel_work_sync() added for the qpair teardown lives in the\nresponse free path, which runs after the request queue is already freed,\nso it does not protect rsp-\u003ereq.\n\nRelease the response-queue interrupt and flush qpair-\u003eq_work before\ndeleting the request queue, so no late completion can reach the freed\nrequest queue. Clearing have_irq makes the subsequent\nqla25xx_free_rsp_que() skip its free_irq(), and the firmware\nqueue-delete order (request then response) is preserved; the\nrequest-delete mailbox completes on the default vector and is unaffected\nby dropping the qpair response interrupt early.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: qla2xxx: Quiesce response IRQ before freeing request queue","id":"CVE-2026-89848","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path","id":"CVE-2026-89849"},"packages":[],"prev":{"headline":"scsi: qla2xxx: Avoid double completion in async IOCB timeout","id":"CVE-2026-89847"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the qla2xxx SCSI driver allows attackers to trigger memory corruption via race conditions during queue deletion, potentially leading to code execution or crashes.","url":"https://insights.sbomify.com/CVE-2026-89848/"}