EUVD-2026-80464

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89864

CVE-2026-89864 is a buffer overflow in the Linux kernel 's scsi: qla2xxx driver. The struct qla_i2c_access carries a 16-bit length field paired with a fixed 64-byte buffer , but qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. Because the s...

CVE-2026-89865

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

CVE-2026-89864

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89863

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

CVE-2026-89862

CVE-2026-89862 affects the Linux kernel in the scsi: qla2xxx driver. The function qla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally, signaling to the FC BSG transport that the driver owns and will complete the request. However, bsg_job_done() is guarded by an if (!rval) check...

CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

EUVD-2026-80462

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

EUVD-2026-80461

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition In the format 1 path, the virtual port is located on ha-vplist while holding vportslock, but the lock is dropped before vp is used: qlaupdatehostmap is called and...

EUVD-2026-80460

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition In the format 1 path, the virtual port is located on ha-vplist while holding vportslock, but the lock is dropped before vp is used: qlaupdatehostmap is called and...

CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89861

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition In the format 1 path, the virtual port is located on ha-vplist while holding vportslock, but the lock is dropped before vp is used: qlaupdatehostmap is called and...

CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition In the format 1 path, the virtual port is located on ha-vplist while holding vportslock, but the lock is dropped before vp is used: qlaupdatehostmap is called and...

CVE-2026-89861

A use-after-free vulnerability exists in the Linux kernel's qla2xxx SCSI driver, specifically in qla24xx_report_id_acquisition(). In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before the vport is subsequently used by qla_upd...