CVE-2026-89847

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the qla2xxx SCSI driver. The function qla2x00 async iocb timeout() attempts to abort a timed-out asynchronous Input Output Control Block (IOCB). When qla24xx async abort cmd() fails, the system calls sp->done() unconditionally without verifying if the SCSI Request Block (SRB) was actually found and removed from the outstanding cmds[] array. If the Interrupt Service Routine (ISR) completes the handle first, it removes the SRB and executes the completion. Subsequently, the timeout handler may issue a second call to sp->done() via qla ctrlvp sp done(), leading to a write operation into a freed stack frame.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.