In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

qla2x00_status_entry() filters out non-TYPE_SRB entries and the
SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a
SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first
thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the
subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.

The srb u union overlays the SCSI command pointer with other command
layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected
STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a
non-NULL garbage pointer, bypassing the NULL checks in
qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and
leading to a wild pointer dereference.

Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast
path. The outstanding_cmds slot is left untouched so a genuinely
non-SCSI command still completes through its proper handler.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < 9204fb0888374083be74f799049649a17eab4191
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < b7418198b45b327194b97f856fe8ea8daa91f3fd
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < 8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < e38041b47c29316ba79b645e2ae0b713d216b1db
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < 29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9
dd30706e73b70d67e88fdaca688db7a3374fd5de affected < 0f41d07d72f2245208c45374ca8d0a1846cad667
Linux Linux affected
Version Status Constraints
5.15 affected —
0 unaffected < 5.15
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0f41d07d72f2245208c45374ca8d0a1846cad667 cve-icon cve-icon
https://git.kernel.org/stable/c/29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9 cve-icon cve-icon
https://git.kernel.org/stable/c/8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6 cve-icon cve-icon
https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191 cve-icon cve-icon
https://git.kernel.org/stable/c/b7418198b45b327194b97f856fe8ea8daa91f3fd cve-icon cve-icon
https://git.kernel.org/stable/c/e38041b47c29316ba79b645e2ae0b713d216b1db cve-icon cve-icon
https://git.kernel.org/stable/c/e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805 cve-icon cve-icon
History

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
Title scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-16T14:39:18.117Z

Reserved: 2026-09-11T19:38:34.770Z

Link: CVE-2026-89849

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T11:16:52.497

Modified: 2026-09-16T15:18:13.230

Link: CVE-2026-89849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.