CVE-2026-89849

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

qla2x00_status_entry() filters out non-TYPE_SRB entries and the

SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a

SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first

thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the

subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.

The srb u union overlays the SCSI command pointer with other command

layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected

STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a

non-NULL garbage pointer, bypassing the NULL checks in

qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and

leading to a wild pointer dereference.

Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast

path. The outstanding_cmds slot is left untouched so a genuinely

non-SCSI command still co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References