CVE-2026-89849 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
A missing type check in the qla2xxx SCSI driver allows firmware to trigger a wild pointer dereference, causing a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89849?
CVE-2026-89849 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference.
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
Which versions are affected by CVE-2026-89849?
How do I fix CVE-2026-89849?
Apply the vendor's patch.
Is CVE-2026-89849 being exploited?
There is no known exploitation of CVE-2026-89849 in the wild and no public exploit code.
Sources
Also known as AZL-101682, BELL-CVE-2026-89849, DEBIAN-CVE-2026-89849, GHSA-3v4r-7crj-gvc7, UBUNTU-CVE-2026-89849.