Linux kernel qla2xxx: double completion in async IOCB timeout frees a live stack frame

Impact

When qla24xx_async_abort_cmd() fails, the timeout handler called sp->done() without checking whether it had actually removed the SRB from outstanding_cmds[]. If the response ISR completed the same handle first, the submitter in qla24xx_control_vp() has already returned and reclaimed its on-stack completion; the second sp->done() then calls complete() into that freed frame - a use-after-free in kernel stack memory. Reaching it needs Fibre Channel command timeouts racing late completions, which is a fabric-fault or flaky-target condition, not something a tenant steers. Nodes with QLogic FC HBAs attached to shared storage are the ones to look at; everyone else does not run this code.

Who can reach it

Local and hardware-dependent: requires a QLogic FC HBA and an async IOCB timing out while the response queue completes the same handle. No tenant-reachable path is described in the record.

What to do

Update to a kernel carrying the sp_found guard on this path and reboot the affected storage-attached nodes. Headless GPU nodes without qla2xxx-driven FC HBAs are unaffected and need no action. The record lists stable commits only, no distribution-fixed version.

References

Related entries

• Linux kernel qla2xxx: NVMe LS reject path advances the request ring without the qpair lockCVE-2026-89857 · Linux kernel qla2xxx (NVMe-FC LS reject, request ring locking)Critical
• Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive bufferCVE-2026-89969 · Linux kernel nvmet-tcp (NVMe-over-TCP target PDU receive)Critical
• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical
• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical
• Linux kernel CephFS client: use-after-free when an MDS session reopens during an access checkCVE-2026-89990 · Linux kernel CephFS client (ceph_mds_check_access)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps a blocked lockCVE-2026-90036 · Linux kernel NFSD (blocked-lock laundromat reaping)Critical