CVE-2026-89844: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition
qla24xxreportidacquisition() format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap() without the lock. That reaches qlaupdatevpmap(), which mutates the ha->hostmap btree via btreeinsert32()/btreeupdate32()/btreeremove32() and is documented to require vportslock to be held by the caller. Running it unlocked can race concurrent hostmap updates and corrupt the btree.
The format-2 path in the same function already wraps its hostmap update (SETALPA) in vportslock; the format-1 path is the lone outlier.
Hold vportslock across the format-1 qlaupdatehostmap() call to honor the documented locking contract. The vrefcount taken in the loop keeps the vport valid, so this only adds the missing hostmap serialization.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In qla24xx_report_id_acquisition() format-1 handling, hold vport_slock across the call to qla_update_host_map() (i.e., do not drop vport_slock after taking the vport reference); format-2 already wraps the host_map update. This preserves the documented locking contract required for btree_insert32()/btree_update32()/btree_remove32() operations and prevents concurrent host_map updates from corrupting the btree.
Linux kernel scsi: qla2xxx (qla24xx report ID acquisition / qla_update_host_map) vport_slock locking = held across qla_update_host_map() call in format-1 report ID acquisition
Event History
Frequently Asked Questions
Which systems are exposed to the race condition?
Linux kernel systems using the qla2xxx driver are exposed when the format-1 handling in qla24xx_report_id_acquisition() performs host-map updates concurrently with other host_map updates. The issue concerns mutation of the adapter's ha->host_map btree without the required vport_slock serialization.
What is the likely effect if the race occurs?
Concurrent unlocked updates can corrupt the ha->host_map btree. The provided information does not describe an attacker prerequisite, exploitation method, or a specific externally observable symptom.
Is the format-2 report-ID path affected in the same way?
No. The format-2 path already holds vport_slock while performing its SET_AL_PA host-map update; the format-1 path was identified as the outlier.