CVE-2026-89847

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Avoid double completion in async IOCB timeout

qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When

qla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the

SRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then

call sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking

whether the SRB was actually found and removed.

If the response ISR completes the same handle first, it removes the SRB

under qp_lock_ptr and runs sp->done() -> complete(sp->comp). The

submitter qla24xx_control_vp() wakes from wait_for_completion(), clears

sp->comp, drops its reference and returns, reclaiming the on-stack

completion. The timer reference keeps the SRB alive across the timeout

handler, but not the submitter's stack. The timeout then issues a second

sp->done() -> qla_ctrlvp_sp_done(), which evaluates "if (sp->comp)

complete(sp->comp)"; with the pointer loaded be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References