Linux kernel qla2xxx: unexpected status IOCB for a non-SCSI handle causes a wild pointer dereference

Impact

qla2x00_status_entry() fell through to a SCSI-only fast path for SRB types it had not explicitly excluded, and that path dereferences sp->u.scmd.cmd out of a union that may actually hold a bsg_job or iocb_cmd layout. A STATUS_TYPE IOCB delivered for a non-SCSI handle therefore yields a non-NULL garbage pointer that passes the existing NULL checks, and the driver dereferences it in interrupt context. On a GPU node this matters where QLogic FC HBAs front the shared storage that feeds training data or checkpoints: the crash takes the whole node down, and a node holding long-running jobs cannot be drained cheaply. The record attributes an adjacent-network vector, meaning the trigger is a response from the fabric rather than anything a tenant submits.

Who can reach it

Not reachable from a tenant workload. Requires the HBA to deliver an unexpected status IOCB - a misbehaving or malicious device on the Fibre Channel fabric, or faulty firmware. No host authentication is involved; only nodes with QLogic FC HBAs are affected.

What to do

Take the fix from the linked stable commits or update to a patched distribution kernel, then reboot each affected node. There is no runtime mitigation short of not using qla2xxx-attached storage; nodes without QLogic FC HBAs are unaffected and can be left alone.

References

Related entries

• Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue listCVE-2026-89860 · Linux kernel qla2xxx (FC-NVMe abort path, priv->abort_work)High
• KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tablesCVE-2026-89913 · Linux kernel KVM arm64 vgic-v3 (vgic_v3_save_pending_tables LPI iteration)High
• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High
• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High
• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High
• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High