CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
A use-after-free in the qla2xxx SCSI driver allows attackers to execute arbitrary code or escalate privileges via concurrent vport deallocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89861?
CVE-2026-89861 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before vp is used: qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/ REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport down and free it, leading to a use-after-free.
Take a vport reference (vref_count) under vport_slock when the matching vp is found, and drop it after the last use of vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before unlinking and freeing the vport, so the pointer stays valid. This matches the reference idiom already used by the other ha->vp_list traversals.
Which versions are affected by CVE-2026-89861?
How do I fix CVE-2026-89861?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89861 being exploited?
There is no known exploitation of CVE-2026-89861 in the wild and no public exploit code.
Sources
Also known as AZL-101339, BELL-CVE-2026-89861, DEBIAN-CVE-2026-89861, GHSA-jp2p-cx4h-xhw3, UBUNTU-CVE-2026-89861.