{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-89861",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-89861"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n\nIn the format 1 path, the virtual port is located on ha->vp_list while\nholding vport_slock, but the lock is dropped before vp is used:\nqla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport\ndown and free it, leading to a use-after-free.\n\nTake a vport reference (vref_count) under vport_slock when the matching\nvp is found, and drop it after the last use of\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before\nunlinking and freeing the vport, so the pointer stays valid. This\nmatches the reference idiom already used by the other ha->vp_list\ntraversals.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89861"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - qla24xx_report_id_acquisition() runs from qla24xx_process_response_queue() and the ATIO MSI-X path on firmware VP_RPT_ID IOCBs after fabric FDISC or VP_STAT_ID_CHG. QLogic CNAs speak FCoE and SANs are stretched via FCIP, so a remote SAN peer drives this without a local syscall, matching sibling CVE-2026-89848.\nAC:H - The use-after-free requires qla24xx_deallocate_vp_id() to unlink the vport and scsi_host_put() it after the ISR drops vport_slock, which occurs only during NPIV vport deletion or failed vport create, a victim state a fabric attacker cannot initiate.\nPR:N - Report-ID IOCBs are firmware completions of unauthenticated Fibre Channel fabric login and N_Port ID assignment. The interrupt path performs no Linux credential or capability check, so a fabric peer needs no account on the victim host.\nUI:N - VP_RPT_ID handling runs automatically from the HBA interrupt and qla_do_work paths when the fabric assigns or changes an NPIV port ID. Concurrent vport teardown occurs during routine NPIV delete or driver remove, without a mount, open, or other interactive victim step.\nS:U - The use-after-free is of scsi_qla_host inside the host kernel qla2xxx driver and does not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - After scsi_host_put() frees the vport, the ISR still calls qla_update_host_map() and set_bit() on the dangling scsi_qla_host. That kernel heap use-after-free enables disclosure of reused object contents.\nI:H - qla_update_host_map() writes the freed vport's d_id and inserts the dangling vha pointer into ha->host_map, and set_bit() writes vp_flags/dpc_flags on the freed object, yielding a kernel write and control-flow hijack primitive.\nA:H - Use-after-free of scsi_qla_host from interrupt or qla_do_work context produces a kernel oops or panic even when not fully exploited, taking down storage served by the adapter."
    }
  }
}