CVE-2026-89854 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.
Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel driver for QLogic qla2xxx SCSI hosts contains a critical use-after-free vulnerability within its hardware teardown sequence, specifically involving the management of the CS84XX chip context structure. This flaw arises from an incorrect ordering of resource deallocation during host removal or PCI error handling scenarios. The core issue lies in the function qla84xx_put_chip(), which is responsible for dropping the final reference count to the ha->cs84xx pointer and subsequently freeing that memory via __qla84xx_chip_release(). However, this operation was executed before scsi_remove_host() completes its cleanup procedures. This sequencing error creates a dangerous race condition window where system resources are freed while they may still be accessible through other kernel interfaces.
The operational impact of this vulnerability is most visible when userspace applications or internal kernel mechanisms attempt to read the 84xx_fw_version host sysfs attribute during the teardown process. The scsi_remove_host() function is responsible for removing these sysfs attributes, ensuring that no new reads can occur and draining any in-flight requests. Because qla84xx_put_chip() was called prior to this removal, there exists a temporal gap where the cs84xx structure has been freed but the corresponding sysfs attribute remains registered and accessible. If a concurrent read operation targets the 84xx_fw_version attribute during this interval, it triggers the callback function qla24xx_84xx_fw_version_show(). This function attempts to dereference ha->cs84xx to retrieve version information, resulting in a use-after-free condition as it accesses memory that has already been returned to the allocator.
From a security and stability perspective, this vulnerability is classified under CWE-416: Use After Free. The exploitation of this flaw could lead to kernel panics, denial of service, or potentially arbitrary code execution if an attacker can control the contents of the freed memory region through heap spraying techniques before it is reallocated for unrelated purposes. This aligns with ATT&CK technique T1059, specifically command and script interpretation via system utilities that might interact with sysfs attributes to trigger the vulnerable path. The severity is heightened by the fact that this occurs during standard driver removal or error recovery paths, which may be triggered remotely if PCI errors are induced or through local privilege escalation vectors where a user can initiate device unbinding.
The resolution involves correcting the initialization and teardown order within both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). The fix mandates moving the call to qla84xx_put_chip() to occur after scsi_remove_host() has returned. This ensures that all sysfs attributes associated with the host are unregistered before any reference counts for internal structures like cs84xx are dropped. By guaranteeing that kernfs has drained all in-flight show callbacks, the driver eliminates the race condition window entirely. The memory is still freed at an appropriate time relative to the overall host and ha structure lifecycles, maintaining proper resource management while preventing illegal access to deallocated memory. This adjustment reinforces the principle of defensive programming by ensuring that external interfaces are closed before internal state is invalidated.