CVE-2026-89861

A use-after-free vulnerability exists in the Linux kernel's qla2xxx SCSI driver, specifically in qla24xx_report_id_acquisition(). In the format 1 path, the virtual port is located on ha->vp_list while holding vport_slock, but the lock is dropped before the vport is subsequently used by qla_upd...

CVE-2026-89860

CVE-2026-89860 affects the qla2xxx (QLogic) SCSI driver in the Linux kernel , specifically its NVMe abort handling. The root cause is that qla_nvme_fcp_abort() and qla_nvme_ls_abort() called INIT_WORK() on priv->abort_work immediately before schedule_work(). When an abort is issued more than o...

CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89859 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

CVE-2026-89859

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

EUVD-2026-80459

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

CVE-2026-89859

This Linux kernel vulnerability affects the scsi: qla2xxx (QLogic Fibre Channel HBA) driver. In qla2x00_do_dport_diagnostics(), the qla_dport_diag response buffer is allocated with kmalloc_obj() (non-zeroing), but only a subset of the buffer is populated by the user request. The options and unuse...

EUVD-2026-80457

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89858

CVE-2026-89858 affects the Linux kernel's qla2xxx SCSI driver in the function qla2x00_update_fru_versions(). A user-supplied BSG request is copied into a fixed 256-byte stack buffer , and the loop iteration count (list->count) is taken directly from user input with no upper bound , while only ...

CVE-2026-89857 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89857

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89858

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

EUVD-2026-80458

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89857

CVE-2026-89857 affects the Linux kernel qla2xxx SCSI driver, specifically the NVMe-FC path. The root cause is a missing lock : qla_nvme_ls_reject_iocb() allocates and advances the request ring assuming the hardware lock is held, but two callers—qla_nvme_xmt_ls_rsp() (NVMe-FC transport callback er...

CVE-2026-89856 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

CVE-2026-89856 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

CVE-2026-89856

A vulnerability in the Linux kernel qla2xxx SCSI driver arises from a type-width mismatch: ha->msix_count is u16 while derived queue counts (max_req_queues, max_rsp_queues, max_qpairs) are u8 . A device (physical or hot-plugged) advertising 257 MSI-X vectors causes msix_count - 1 to equal 256,...

CVE-2026-89856

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

CVE-2026-89855

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...