CVE-2026-89853: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free. Unpublish ha->fce under hardware_lock, then release the lock and free the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either completes its check and copy with the buffer still valid, or observes ha->fce == NULL and skips it.

Affected products

Linux kernel: from 5.10.235 before 5.10.270; from 5.15.179 before 5.15.221; from 6.1.129 before 6.1.188; from 6.6.78 before 6.6.157; from 6.12.14 before 6.12.110; from 6.13.3 before 6.14 — fixed in 5.10.270, 5.15.221, 6.1.188, 6.12.110, 6.14, 6.6.157

How to fix

Upgrade to a fixed version: Linux kernel 5.10.270, 5.15.221, 6.1.188, 6.12.110. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89853 or the next vulnerability affects your stack