Database/Kernel, userspace & hypervisor
Linux kernel qla2xxx: use-after-free reading 84xx_fw_version during Fibre Channel HBA teardown
Impact
qla84xx_put_chip() freed ha->cs84xx without clearing the pointer, and ran before scsi_remove_host() removed the 84xx_fw_version sysfs attribute. A read of that attribute in the window between the two calls dereferences freed memory. Reaching it requires an HBA teardown - driver unbind, module removal, or the PCI error disable path - concurrent with a sysfs read, so this is an administrative/monitoring-tool race rather than something a tenant drives. It matters to operators running QLogic 84xx Fibre Channel HBAs for shared storage on GPU or HPC nodes: a monitoring agent polling HBA firmware versions while a card faults out can corrupt kernel memory on a node that holds storage paths for running jobs. Fleets that are entirely NVMe or RDMA-attached are not affected.
Who can reach it
Local read of the qla2xxx 84xx_fw_version sysfs attribute racing an HBA removal or PCI error path. Needs sysfs read access and an affected QLogic 84xx card; not remotely reachable.
What to do
Update to a stable kernel with the reordered qla84xx_put_chip() call (five stable commits referenced) and reboot the affected storage-attached nodes. No fixed release version is stated. Interim: avoid unbinding or reloading qla2xxx while monitoring agents poll HBA sysfs attributes.
References
Related entries
- Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN arrayCVE-2026-89967 · Linux kernel mm/migrate_device (device-private page migration)High
- Linux kernel mm/mempolicy: weighted-interleave bulk allocation sleeps in atomic contextCVE-2026-89986 · Linux kernel mm/mempolicy (alloc_pages_bulk_weighted_interleave GFP flags)High
- Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commandsCVE-2026-90008 · Linux kernel megaraid_sas (NVMe PRP chain frame)High
- Linux kernel SCSI bsg: TOCTOU on the shared io_uring SQE overflows the SCSI command bufferCVE-2026-90009 · Linux kernel SCSI bsg (io_uring passthrough command setup)High
- Linux kernel bsg: sense data copy ignores max_response_len and overruns the user bufferCVE-2026-90010 · Linux kernel SCSI bsg (io_uring sense copy)High
- Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.