CVE-2026-89844: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition
qla24xxreportidacquisition() format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap() without the lock. That reaches qlaupdatevpmap(), which mutates the ha->hostmap btree via btreeinsert32()/btreeupdate32()/btreeremove32() and is documented to require vportslock to be held by the caller. Running it unlocked can race concurrent hostmap updates and corrupt the btree.
The format-2 path in the same function already wraps its hostmap update (SETALPA) in vportslock; the format-1 path is the lone outlier.
Hold vportslock across the format-1 qlaupdatehostmap() call to honor the documented locking contract. The vrefcount taken in the loop keeps the vport valid, so this only adds the missing hostmap serialization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In qla24xx_report_id_acquisition() format-1 handling, hold vport_slock across the qla_update_host_map() call so host_map updates are serialized and the btree cannot be concurrently corrupted.
Event History
Frequently Asked Questions
Which systems are exposed to the race condition?
Linux kernel systems using the qla2xxx driver are exposed when the format-1 handling in qla24xx_report_id_acquisition() performs host-map updates concurrently with other host_map updates. The issue concerns mutation of the adapter's ha->host_map btree without the required vport_slock serialization.
What is the likely effect if the race occurs?
Concurrent unlocked updates can corrupt the ha->host_map btree. The provided information does not describe an attacker prerequisite, exploitation method, or a specific externally observable symptom.
Is the format-2 report-ID path affected in the same way?
No. The format-2 path already holds vport_slock while performing its SET_AL_PA host-map update; the format-1 path was identified as the outlier.