CVE-2026-89848

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Quiesce response IRQ before freeing request queue

qla2xxx_delete_qpair() deletes the request queue before the response

queue. qla25xx_delete_req_que() frees the request queue memory

(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is

only released later, in qla25xx_free_rsp_que(). In that window the

response interrupt can still fire, qla2xxx_msix_rsp_q() queues

qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue()

dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the

status path), a use-after-free.

The cancel_work_sync() added for the qpair teardown lives in the

response free path, which runs after the request queue is already freed,

so it does not protect rsp->req.

Release the response-queue interrupt and flush qpair->q_work before

deleting the request queue, so no late completion can reach the freed

request queue. Clearing have_irq makes the subsequ

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References