CVE-2026-89851

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the qla2x00 dfs fce write() function within the scsi qla2xxx driver. The function calls kstrtoul() using a NULL result pointer, which leads to a NULL pointer dereference and a system oops upon a successful parse. Additionally, the integer return value of kstrtoul() is incorrectly assigned to the unsigned long enable flag, causing the logic to be inverted: valid numeric inputs are treated as a command to disable FCE (Fibre Channel Ethernet), while parsing failures inadvertently enable it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.