CVE-2026-89862: scsi: qla2xxx: Fix BSG job leak on validate flash image error path
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix BSG job leak on validate flash image error path
qla28xxvalidateflashimage() returns QLASUCCESS (0) unconditionally, telling the FC BSG transport (fcbsghostdispatch()) that the driver owns and will complete the request. But bsgjobdone() is guarded by "if (!rval)", so on the error path (rval == -EINVAL) neither the driver nor the transport completes the job. The request dangles until it times out, leaking block layer resources.
Commit c2c68225b145 ("scsi: qla2xxx: Fix bsgdone() causing double free") added the "if (!rval)" guard to a batch of BSG handlers. That is correct for handlers that also return the error code (the transport then completes the job once via failhostmsg), but this function returns QLASUCCESS unconditionally, so the guard turned a correct single completion into a leak.
Always call bsgjobdone(): bsgreply->result is DIDOK and the error is reported in vendorrsp[0], and since the function returns 0 the transport will not complete the job a second time.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
scsi: qla2xxx: Fix BSG job leak on validate flash image error pathto a version that resolves this vulnerability.Patch c2c68225b145
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel qla2xxx Fibre Channel driver and issuing FC BSG flash-image validation requests can encounter the leak. The affected path is specifically the qla28xx_validate_flash_image() validation error path.
What triggers the resource leak?
A flash-image validation request must fail with -EINVAL. In that case, the function returns success to the FC BSG transport but does not call bsg_job_done(), leaving the request outstanding until timeout and leaking block-layer resources.
How can I tell whether this is occurring?
The observable behavior described is a dangling FC BSG request that times out after an invalid flash-image validation attempt, accompanied by leaked block-layer resources. The provided information does not identify a specific log message or diagnostic counter.
What is the relevant fix behavior?
The fix completes the BSG job on both successful and failed validation paths by always calling bsg_job_done(). The error remains reported through vendor_rsp[0], while the function returns 0 so the FC BSG transport does not complete the job a second time.