CVE-2026-89854 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
A use-after-free in the qla2xxx SCSI driver allows local attackers to execute arbitrary code or escalate privileges via concurrent sysfs access during host teardown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89854?
CVE-2026-89854 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.
Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
Which versions are affected by CVE-2026-89854?
How do I fix CVE-2026-89854?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89854 being exploited?
There is no known exploitation of CVE-2026-89854 in the wild and no public exploit code.
Sources
Also known as AZL-101412, BELL-CVE-2026-89854, DEBIAN-CVE-2026-89854, GHSA-9v3f-qp8w-f486, UBUNTU-CVE-2026-89854.