CVE-2026-89849 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference.
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel SCSI subsystem, specifically within the qla2xxx driver for QLogic Fibre Channel host bus adapters, contained a critical logic flaw in its status IOCB fast path processing routine known as qla2x00_status_entry(). This vulnerability stems from an insufficient type validation mechanism when handling incoming firmware status indicators. The function is designed to filter out specific non-SCSI command types such as SRB_NVME_CMD, SRB_BIDI_CMD, and SRB_TM_CMD before proceeding with standard SCSI processing logic. However, the filtering logic failed to account for all possible non-TYPE_SRB entries or incorrectly assumed that any entry not explicitly excluded was a valid SCSI Request Block (SRB). This oversight allowed unexpected STATUS_TYPE IOCBs associated with non-SCSI handles to bypass initial safety checks and enter a code path that strictly assumes the presence of a standard SCSI command structure.
The technical core of this vulnerability lies in how memory is managed within the driver's data structures. The SRB control block utilizes a union type for its u member, which overlays different command layouts including bsg_job, iocb_cmd, and scmd (SCSI command). When firmware delivers an unexpected status IOCB that does not correspond to a standard SCSI command, the sp->u.scmd.cmd field may contain garbage data or a non-NULL pointer value rather than NULL. The subsequent functions in this fast path, particularly qla_chk_edif_rx_sa_delete_pending(), rely on evaluating GET_CMD_SP(sp), which directly accesses sp->u.scmd.cmd to retrieve the SCSI command pointer. Because the input was not properly validated against all possible invalid types, these functions received a corrupted or arbitrary memory address instead of a valid command structure or NULL.
This misinterpretation leads to a wild pointer dereference with severe operational consequences. The code proceeds to evaluate conditions based on this garbage pointer value, effectively bypassing critical NULL checks that are intended to prevent operations on uninitialized or invalid objects. When the kernel attempts to access memory at this arbitrary address, it triggers an undefined behavior scenario that typically results in a kernel panic or system crash due to an illegal memory access. In environments where remote code execution is possible through crafted firmware interactions or specific hardware states, this could potentially be exploited for denial of service attacks against critical infrastructure relying on QLogic storage connectivity. The vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) in the context of improper validation leading to unsafe memory access and falls under ATT&CK technique T1055 Process Injection if leveraged for further exploitation, though primarily it manifests as a stability issue categorized by CWE-823 Use of Out-of-range Pointer Offset or CWE-476 NULL Pointer Dereference depending on the specific garbage value encountered.
The resolution implemented in this patch enforces strict type checking before entering the SCSI fast path logic. By rejecting any SRB whose type is not explicitly identified as SRB_SCSI_CMD, the driver ensures that only valid SCSI commands proceed to functions expecting standard command structures. This fix preserves system stability by preventing the execution of code paths with invalid pointers while maintaining correct operational flow for genuinely non-SCSI commands through their designated handlers without disturbing outstanding command slots. To mitigate similar risks in related drivers or future developments, developers should implement comprehensive input validation that explicitly whitelists expected types rather than blacklisting known bad ones, ensuring that all union members are accessed only after verifying the active type field matches the intended structure layout.