{"id":"CVE-2026-89845","revision":"f7ffb3944f354a4ba2fa8f8c8755449b","records":[{"revision":"f7ffb3944f354a4ba2fa8f8c8755449b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89845","aliases":[],"title":"scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL\ncheck and again when assigning it to req. The map slot is cleared by\nqla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)\nduring queue teardown, while the response-queue interrupt that drives\nqla2x00_error_entry() is still registered (the IRQ is released later in\nqla25xx_free_rsp_que()). If the slot is set to NULL between the two\nreads, req becomes NULL and is dereferenced.\n\nRead the slot once into req and NULL-check the local before use. mq_lock\nis a mutex and cannot be taken from interrupt context, so the single\nread plus local check is the appropriate fix for the reported NULL\ndereference.","state":0,"publishedAt":"2026-09-16T10:31:19.374+00:00","modifiedAt":"2026-10-19T08:53:38.186+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_isr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"c845f2597787ef70159a32566669e308b2807a56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"fe04b31e386aee4cc3a18f07462af146037dc389\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"1b995cf4157465357d66ba096e7cdaafab9972e7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"d79376fbd2a076de82c1cd8aa0b600b300c75a44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"1c90b74e484ba48f31944fe04963d99e01ac3767\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"5dd9bec8004ba93cee8b689bf54ce294f59e5e3c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"35124cfa9898b2088ee72859e573e0876aff66fc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b\",\n                            \"lessThan\": \"deb8abde83a799d2501f3977f6d6051000253f5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_isr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56","https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389","https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7","https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44","https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767","https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c","https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc","https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89845","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89845","identifiers":["CVE-2026-89845"]},"retained":false,"historicalAffected":[]}],"coverage":[]}