{"id":"CVE-2026-89862","revision":"6d53e83b12dc4e7a95245ec967b20ca8","records":[{"revision":"6d53e83b12dc4e7a95245ec967b20ca8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89862","aliases":[],"title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix BSG job leak on validate flash image error path\n\nqla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally,\ntelling the FC BSG transport (fc_bsg_host_dispatch()) that the driver\nowns and will complete the request. But bsg_job_done() is guarded by \"if\n(!rval)\", so on the error path (rval == -EINVAL) neither the driver nor\nthe transport completes the job. The request dangles until it times out,\nleaking block layer resources.\n\nCommit c2c68225b145 (\"scsi: qla2xxx: Fix bsg_done() causing double\nfree\") added the \"if (!rval)\" guard to a batch of BSG handlers. That is\ncorrect for handlers that also return the error code (the transport then\ncompletes the job once via fail_host_msg), but this function returns\nQLA_SUCCESS unconditionally, so the guard turned a correct single\ncompletion into a leak.\n\nAlways call bsg_job_done(): bsg_reply->result is DID_OK and the error is\nreported in vendor_rsp[0], and since the function returns 0 the\ntransport will not complete the job a second time.","state":0,"publishedAt":"2026-09-16T10:31:33.698+00:00","modifiedAt":"2026-10-19T08:53:55.681+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_bsg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0\",\n                            \"lessThan\": \"e25241f9fa01fb0c088381a156d84a725b71c1ef\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0\",\n                            \"lessThan\": \"0fb52cc632464b0cd07f970341330466d772efe1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"057a5bdc481e58ab853117254867ffb22caf9f6e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"27ac9679c43a09e54e2d9aae9980ada045b428e0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"74e7458537cd9349cf019862e51491f670871707\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"871f6236da96c4a9712b8a29d7f555f767a47e95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"31f33b856d2324d86bcaef295f4d210477a1c018\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"708003e1bc857dd014d4c44278d7d77c26f91b1c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.251\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.201\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.164\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.127\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.74\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.13\",\n                            \"lessThan\": \"6.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.3\",\n                            \"lessThan\": \"6.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/qla2xxx/qla_bsg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e25241f9fa01fb0c088381a156d84a725b71c1ef","https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89862","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89862","identifiers":["CVE-2026-89862"]},"retained":false,"historicalAffected":[]}],"coverage":[]}