{"id":"CVE-2026-89857","revision":"a2bedf28aedd4b07b3fe0e6d7f6be857","records":[{"revision":"a2bedf28aedd4b07b3fe0e6d7f6be857","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89857","aliases":[],"title":"scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold qpair lock when sending NVMe LS reject\n\nqla_nvme_ls_reject_iocb() allocates from and advances the request ring\nthrough __qla2x00_alloc_iocbs() (which assumes the hardware_lock is\nheld) and qla2x00_start_iocbs() (which advances the ring and rings the\nrequest-in doorbell), but takes no lock itself. Two of its callers\ninvoke it without the producer lock held:\n\n - qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on\n   its error path, and\n\n - qla2xxx_process_purls_pkt(), run from the purex work/DPC context.\n\nBoth use ha->base_qpair, whose qp_lock_ptr is hardware_lock, so they can\nrun concurrently with normal I/O submission on the base ring and corrupt\nthe ring producer state, leading to duplicated or dropped commands. The\nthird caller, qla2xxx_process_purls_iocb(), runs inside\nqla24xx_process_response_queue() with the qpair lock already held and is\nsafe; that is also why the lock cannot be taken inside the helper itself\n(it would recursively re-acquire hardware_lock on the response path).\n\nTake qp_lock_ptr around the two unlocked callers and document the helper\nas caller-locked. Both run in process context, so spin_lock_irqsave() is\nused and nothing in the locked region sleeps.","state":0,"publishedAt":"2026-09-16T10:31:30.193+00:00","modifiedAt":"2026-10-19T08:53:49.961+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_nvme.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"875386b98857822b77ac7f95bdf367b70af5b78c\",\n                            \"lessThan\": \"7eb618877503edbf17aa65e357a81bda1fc8f163\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"875386b98857822b77ac7f95bdf367b70af5b78c\",\n                            \"lessThan\": \"b3a362466db6b8ec47cc537ac641ac197fa69b5d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"875386b98857822b77ac7f95bdf367b70af5b78c\",\n                            \"lessThan\": \"11834e5773e20fd3742d7eb900876e66b9e7d029\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"875386b98857822b77ac7f95bdf367b70af5b78c\",\n                            \"lessThan\": \"b02ff132017b28222187ebcf95ce7f4cb576cd36\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"875386b98857822b77ac7f95bdf367b70af5b78c\",\n                            \"lessThan\": \"f743488e4a203049f27ec5d8cd0caccc483af01e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_nvme.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/7eb618877503edbf17aa65e357a81bda1fc8f163","https://git.kernel.org/stable/c/b3a362466db6b8ec47cc537ac641ac197fa69b5d","https://git.kernel.org/stable/c/11834e5773e20fd3742d7eb900876e66b9e7d029","https://git.kernel.org/stable/c/b02ff132017b28222187ebcf95ce7f4cb576cd36","https://git.kernel.org/stable/c/f743488e4a203049f27ec5d8cd0caccc483af01e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89857","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89857","identifiers":["CVE-2026-89857"]},"retained":false,"historicalAffected":[]}],"coverage":[]}