Linux kernel qla2xxx: host_map btree updated without vport_slock in the format-1 path, corrupting the map

Impact

qla24xx_report_id_acquisition() drops vport_slock in its format-1 handling and then calls qla_update_host_map(), which mutates the ha->host_map btree through btree_insert32/update32/remove32 - operations documented to require the lock. Concurrent host_map updates can therefore corrupt the btree, with the usual consequences of a corrupted kernel data structure in the storage path: wrong vport lookups or a crash of a storage-attached node. The format-2 path in the same function already took the lock; only format-1 was missing it. Triggering it requires fabric events that drive report-ID acquisition on a multi-vport HBA.

Who can reach it

Adjacent network - the Fibre Channel fabric. An attacker or faulty device able to generate login/report-ID events against a host running qla2xxx with NPIV vports; no host authentication involved.

What to do

Take a stable kernel containing the linked commits and reboot the affected hosts with the node drained; the module is in the storage path and cannot realistically be reloaded live. Restricting fabric access and NPIV usage reduces the trigger surface in the meantime. The record names commits only, no fixed releases.

References

Related entries

• Linux kernel qla2xxx: unexpected status IOCB for a non-SCSI handle causes a wild pointer dereferenceCVE-2026-89849 · Linux kernel qla2xxx (QLogic Fibre Channel HBA status IOCB fast path)High
• Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue listCVE-2026-89860 · Linux kernel qla2xxx (FC-NVMe abort path, priv->abort_work)High
• KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tablesCVE-2026-89913 · Linux kernel KVM arm64 vgic-v3 (vgic_v3_save_pending_tables LPI iteration)High
• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High
• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High
• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High