CVE-2026-89863

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL – but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context.

Return early when cmd is NULL, before touching cmd->sc_data_direction.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < e479e9b148456905d12711411484b94083c8ff58affected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < 2191b0034a2f1307d421782e6eceddf8eec9e7f6affected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1affected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < 96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8baffected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < 94bfb61478bcb207d27f8cd24fd231421059519faffected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < 75fd6d041c4a325ae37f4683e6678d3015988bb0affected
LinuxLinuxdd30706e73b70d67e88fdaca688db7a3374fd5de < c20ee380ca59c5a8646750c4849969a815924e2eaffected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.51 <= 6.18.*unaffected
LinuxLinux7.2.5 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References