CVE-2026-89863

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the qla chk edif rx sa delete pending() function. The function retrieves a SCSI command using GET CMD SP(sp) and accesses cmd->sc data direction without verifying if the command pointer is NULL. This occurs because the firmware may post a status completion for a command that was already aborted or returned. Since the check for a NULL pointer in the caller function qla2x00 status entry() happens after the dereference in qla chk edif rx sa delete pending(), a NULL command pointer causes a kernel crash in interrupt context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.