CVE-2026-89860

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the scsi qla2xxx driver where the functions qla nvme fcp abort() and qla nvme ls abort() call INIT WORK() on the priv->abort work variable immediately before schedule work(). Because INIT WORK() reinitializes the work struct by resetting its list head and clearing the pending bit, issuing an abort more than once for the same command—such as during concurrent transport teardown and a timeout-driven abort—can reinitialize a work item that is already queued. This can lead to corruption of the workqueue list, resulting in system crashes or a looping worker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.