CVE-2026-89845

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL

check and again when assigning it to req. The map slot is cleared by

qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)

during queue teardown, while the response-queue interrupt that drives

qla2x00_error_entry() is still registered (the IRQ is released later in

qla25xx_free_rsp_que()). If the slot is set to NULL between the two

reads, req becomes NULL and is dereferenced.

Read the slot once into req and NULL-check the local before use. mq_lock

is a mutex and cannot be taken from interrupt context, so the single

read plus local check is the appropriate fix for the reported NULL

dereference.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References