CVE-2026-89844 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
qla24xx_report_id_acquisition() format-1 handling drops vport_slock after taking the vport reference and then calls qla_update_host_map() without the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32()/btree_update32()/btree_remove32() and is documented to require vport_slock to be held by the caller. Running it unlocked can race concurrent host_map updates and corrupt the btree.
The format-2 path in the same function already wraps its host_map update (SET_AL_PA) in vport_slock; the format-1 path is the lone outlier.
Hold vport_slock across the format-1 qla_update_host_map() call to honor the documented locking contract. The vref_count taken in the loop keeps the vport valid, so this only adds the missing host_map serialization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel driver for QLogic Fibre Channel adapters, specifically within the qla2xxx subsystem, contained a concurrency vulnerability related to improper lock management during SCSI report ID acquisition operations. This issue was identified in the handling of format-1 data structures within the qla24xx_report_id_acquisition function. The core technical flaw lies in the sequence of locking and unlocking around critical hardware state updates. Specifically, after acquiring a reference count on the virtual port to ensure its validity during execution, the code path for format-1 processing released the vport_slock before invoking qla_update_host_map. This release occurred despite the fact that the subsequent function call is responsible for mutating internal data structures that are explicitly documented as requiring exclusive access via this specific lock.
The operational impact of this locking omission stems from the interaction between qla_update_host_map and its subordinate routine, qla_update_vp_map. These functions manipulate a binary tree structure known as ha->host_map using operations such as btree_insert32, btree_update32, and btree_remove32. Binary trees are sensitive data structures that rely on strict serialization to maintain their integrity during concurrent modifications. When the vport_slock is not held by the caller, multiple threads or interrupt contexts can simultaneously attempt to modify this tree structure. This lack of mutual exclusion creates a race condition where one thread might be in the middle of restructuring nodes while another thread attempts an insertion, update, or removal. Such concurrency violations typically result in memory corruption, invalid pointer dereferences, or structural inconsistencies within the host map data structure.
From a security and stability perspective, this vulnerability falls under CWE-362, which classifies concurrent execution using shared resources with improper synchronization. The absence of proper locking allows for race conditions that can lead to undefined behavior. In severe cases, corruption of kernel memory structures like binary trees used by device drivers can lead to system crashes or panics, effectively causing a denial of service against the host machine. Furthermore, depending on how the corrupted data is subsequently accessed, there could be potential implications for integrity and potentially confidentiality if sensitive state information is exposed through malformed reads resulting from the structural damage. The vulnerability aligns with ATT&CK techniques related to resource hijacking or disruption via kernel-level instability, although it primarily manifests as a stability issue rather than an exploitable privilege escalation vector in most standard configurations.
The resolution involves modifying the qla24xx_report_id_acquisition function to ensure that vport_slock is held across the entire duration of the qla_update_host_map call for format-1 processing paths. This change aligns the behavior with the documented locking contract and brings it into consistency with the existing implementation for format-2 paths, which already correctly wrap their host map updates in the same lock. The fix leverages the fact that a vref_count is taken within the loop to keep the virtual port object valid throughout the operation, meaning that holding the additional spinlock does not introduce new deadlock risks related to resource availability but rather enforces necessary serialization for data structure integrity. This ensures that all mutations to the ha->host_map btree are atomic with respect to other concurrent updates, thereby preventing race conditions and preserving kernel memory safety.