CVE-2026-89845

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.

Is your site exposed to CVE-2026-89845?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.11%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7 https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767 https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56 https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44 https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389

Frequently Asked Questions

What is CVE-2026-89845? +

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.

How do I check if I'm vulnerable to CVE-2026-89845? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.