CVE-2026-89849: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
qla2x00statusentry() filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is an SRBSCSICMD. The first thing on that path, qlachkedifrxsadeletepending(), and the subsequent handling both evaluate GETCMDSP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command layouts (bsgjob, iocbcmd). If firmware delivers an unexpected STATUSTYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a non-NULL garbage pointer, bypassing the NULL checks in qlachkedifrxsadeletepending() and at the cp == NULL test, and leading to a wild pointer dereference.
Reject any SRB whose type is not SRBSCSICMD before entering the fast path. The outstandingcmds slot is left untouched so a genuinely non-SCSI command still completes through its proper handler.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel qla2xxx driver are exposed when firmware delivers an unexpected STATUS_TYPE IOCB for a non-SCSI handle. The vulnerable fast path can then treat a non-SCSI SRB union member as though it contained a SCSI command pointer.
What is the impact of the erroneous status handling?
A non-NULL value from an overlaid non-SCSI command layout can bypass NULL checks and be dereferenced as a SCSI command pointer. This can result in a wild pointer dereference.
Does the fix interfere with completion of legitimate non-SCSI commands?
No. The fix rejects SRBs whose type is not SRB_SCSI_CMD before the SCSI fast path and leaves the outstanding_cmds slot unchanged, allowing genuine non-SCSI commands to complete through their proper handler.