CVE-2026-89861

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the scsi qla2xxx driver. In the format 1 path, the virtual port is located on ha->vp list while holding vport slock, but the lock is released before the virtual port vp is used. Specifically, when qla update host map() is called and flags such as VP IDX ACQUIRED, REGISTER FC4 NEEDED, or REGISTER FDMI NEEDED are set on vp, no reference is maintained. This allows a concurrent call to the qla24xx deallocate vp id() function to tear down and free the vport, resulting in a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.