CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

🗓️ 16 Sep 2026 10:31:32Reported by GoogleType

osv🔗 osv.dev👁 6 Views

Use-after-free in Linux kernel qla2xxx qla24xx_report_id_acquisition via missing vport reference.

Source	Link
git	www.git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e
git	www.git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb
git	www.git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69
git	www.git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a
git	www.git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf
git	www.git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d
git	www.git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297
git	www.git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89861.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-89861

18 Sep 2026 03:48Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

qla2xxx use-after-free vport reference qla24xx_report_id_acquisition Linux kernel