KernelScan.io

HIGH Introduced in 6.3

qla2xxx HostMap Race

CVE-2026-89844

CVSS 8.8 / 10.0 NVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

KernelScan AI6.4MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition qla24xx_report_id_acquisition() format-1 handling drops vport_slock after taking the vport reference and then calls qla_update_host_map() without the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map btree via btree_insert32()/btree_update32()/btree_remove32() and is documented to require vport_slock to be held by the caller. Running it unlocked can race concurrent host_map updates and corrupt the btree. The format-2 path in the same function already wraps its host_map update (SET_AL_PA) in vport_slock; the format-1 path is the lone outlier. Hold vport_slock across the format-1 qla_update_host_map() call to honor the documented locking contract. The vref_count taken in the loop keeps the vport valid, so this only adds the missing host_map serialization.

02

Engine v0.6.0

Risk summary

Systems equipped with QLogic Fibre Channel HBAs running affected kernel versions are at risk. An attacker with local root access who can perform concurrent virtual port operations may trigger a race that corrupts an internal btree, leading to kernel memory corruption or a panic. The bug requires specific hardware and privileged operations to reach.

Affecteddrivers/scsi/qla2xxx/qla_mbx.c (qla2xxx)

Vulnerability analysis

In the QLogic Fibre Channel driver, one response-handling path updates an internal mapping data structure without acquiring the lock that other paths already take. When two threads concurrently modify this structure—one through the unlocked path and another through a properly locked path—the structure can be corrupted, leading to kernel memory corruption or a crash. The fix adds the missing lock around the vulnerable update, matching the serialization already used elsewhere and restoring the documented locking contract without changing the mechanism that keeps the object valid. The bug is only reachable on systems with a QLogic FC adapter present, and exploitation requires concurrent virtual-port management operations that need root or CAP_SYS_ADMIN privileges.

03

BranchIntroducedFixed inPatch commit
6.186.36.18.51776e4e8cbcf1
6.126.36.12.1106ed66e2a67bb
mainline6.37.3-rc17944039ba9cb
7.26.37.2.57d0b3f745efb
6.66.36.6.157e8f1b0cb9782
cip/6.126.36.12.111-cip326ed66e2a67bb