HIGH Introduced in 5.15
qla2xxx StatusIOCB Deref
CVE-2026-89849
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd. The srb u union overlays the SCSI command pointer with other command layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and leading to a wild pointer dereference. Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast path. The outstanding_cmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
02KernelScan AI Analysis
Risk summary
A local attacker with access to a QLogic/Marvell Fibre Channel adapter can trigger a type confusion in the qla2xxx driver's status completion handler, potentially leading to kernel memory corruption or a system crash. The vulnerability requires the EDIF encryption-in-flight feature to be enabled and specific FC hardware to be present.
Vulnerability analysis
The qla2xxx Fibre Channel driver processes firmware status completions on a fast path that assumes every matching request is a SCSI command. When the adapter firmware delivers an unexpected status completion for a non-SCSI request (such as a BSG or NVMe-FC command), the driver reads a union field that overlays the SCSI command pointer with a different command type's data, producing a garbage pointer that bypasses NULL checks and gets dereferenced. The fix rejects any request whose type is not a SCSI command before entering the fast path, allowing non-SCSI commands to complete through their proper handlers instead. This requires a Marvell/QLogic Fibre Channel adapter with the EDIF encryption feature enabled and is reachable by a local user with access to the adapter's management interface or potentially by a malicious device on the Fibre Channel fabric.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15 | 5.15.221 | 9204fb088837 |
| 6.1 | 5.15 | 6.1.188 | b7418198b45b |
| 6.12 | 5.15 | 6.12.110 | e38041b47c29 |
| 6.18 | 5.15 | 6.18.51 | e93aa3c5125d |
| 6.6 | 5.15 | 6.6.157 | 8f0e31e7a413 |
| 7.2 | 5.15 | 7.2.5 | 29f1f9ad9e35 |
| mainline | 5.15 | 7.3 | 0f41d07d72f2 |
| cip/6.1 | 5.15 | 6.1.189-cip61 | b7418198b45b |
| cip/6.1-rt | 5.15 | 6.1.189-cip61-rt32 | b7418198b45b |
| cip/6.12 | 5.15 | 6.12.111-cip32 | e38041b47c29 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |