CVE-2026-89847: scsi: qla2xxx: Avoid double completion in async IOCB timeout
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid double completion in async IOCB timeout
qla2x00asynciocbtimeout() tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd() fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path scan outstandingcmds[] for the SRB and then call sp->done(sp, QLAFUNCTIONTIMEOUT) unconditionally, without checking whether the SRB was actually found and removed.
If the response ISR completes the same handle first, it removes the SRB under qplockptr and runs sp->done() -> complete(sp->comp). The submitter qla24xxcontrolvp() wakes from waitforcompletion(), clears sp->comp, drops its reference and returns, reclaiming the on-stack completion. The timer reference keeps the SRB alive across the timeout handler, but not the submitter's stack. The timeout then issues a second sp->done() -> qlactrlvpspdone(), which evaluates "if (sp->comp) complete(sp->comp)"; with the pointer loaded before the submitter's NULL store, complete() writes into the freed stack frame, a use-after-free.
Track whether this path removed the SRB from outstandingcmds and only call sp->done() when it did, so the command is completed exactly once by whichever path owns it. This mirrors the spfound guard already used in qla24xxabortiocbtimeout().
Affected Software
Event History
Frequently Asked Questions
Is an async IOCB timeout by itself sufficient to trigger the use-after-free?
No. The vulnerable sequence requires the async abort attempt to fail, the response ISR to complete and remove the same SRB first, and the timeout handler to subsequently invoke the completion callback despite not having removed that SRB from outstanding_cmds[].
What fixes are referenced for this issue?
The referenced stable kernel fixes are commits 71a7b6e3c7f121439f51a058e53d4a8e05b63dec, 7257b5e1fb6c9387714f66e01b79ec82b717eede, and f5b660e0b0d9190d8853c795c2522cc5f8c93003. The fix tracks whether the timeout path actually removed the SRB and calls sp->done() only when it did.