CVE-2026-89848

A use-after-free in the Linux kernel qla2xxx SCSI driver occurs during queue-pair teardown. qla2xxx_delete_qpair() frees the request queue before releasing the response-queue MSI-X interrupt; in that window a late response interrupt can fire and dereference the freed rsp->req pointer via qla24...