CVE-2026-89850 scsi: qla2xxx: Don't query firmware state while chip is down
A logic error in the qla2xxx SCSI driver allows an attacker to hang the adapter by triggering mailbox commands during chip-down states, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89850?
CVE-2026-89850 is a denial of service vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Don't query firmware state while chip is down
qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt.
Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.
Which versions are affected by CVE-2026-89850?
How do I fix CVE-2026-89850?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89850 being exploited?
There is no known exploitation of CVE-2026-89850 in the wild and no public exploit code.
Sources
Also known as AZL-101382, BELL-CVE-2026-89850, DEBIAN-CVE-2026-89850, GHSA-52m9-92gj-jg2v, UBUNTU-CVE-2026-89850.