CVE-2026-89854

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the scsi qla2xxx driver. The function qla84xx put chip() releases the reference to ha->cs84xx and frees it via qla84xx chip release() without clearing the pointer. Because this occurs before scsi remove host(), which is responsible for removing the 84xx fw version host sysfs attribute, a concurrent read of that attribute can trigger the qla24xx 84xx fw version show() function. This function then dereferences the already freed ha->cs84xx pointer, leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.