CVE-2026-89853

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

qla2x00_free_fce_trace() freed and cleared ha->fce while holding only

fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and

qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the

buffer) under hardware_lock and never take fce_mutex. A debugfs FCE

disable could therefore free the DMA buffer between a dump's NULL check

and its copy, resulting in a use-after-free.

Unpublish ha->fce under hardware_lock, then release the lock and free

the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either

completes its check and copy with the buffer still valid, or observes

ha->fce == NULL and skips it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References