AZL-101412 CVE-2026-89854 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown it ran before scsiremovehost, which is...

CVE-2026-89857

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

AZL-101682 CVE-2026-89849 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

DEBIAN-CVE-2026-89848

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

AZL-101573 CVE-2026-89852 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

DEBIAN-CVE-2026-89852

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

AZL-101382 CVE-2026-89850 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...

DEBIAN-CVE-2026-89851

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00dfsfcewrite called kstrtoul with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value 0 on success, negative errno...

DEBIAN-CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

DEBIAN-CVE-2026-89850

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...

CVE-2026-89848

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

AZL-101399 CVE-2026-89851 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00dfsfcewrite called kstrtoul with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value 0 on success, negative errno...

AZL-101286 CVE-2026-89848 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

DEBIAN-CVE-2026-89843

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

DEBIAN-CVE-2026-89842

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

DEBIAN-CVE-2026-89845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

AZL-101205 CVE-2026-89844 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

AZL-101331 CVE-2026-89842 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...