CVE-2026-89863: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
qlachkedifrxsadeletepending() obtains the SCSI command via GETCMDSP(sp) and immediately dereferences cmd->scdatadirection. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00statusentry() acknowledges this on the very same status path, re-fetching GETCMDSP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qlachkedifrxsadeletepending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context.
Return early when cmd is NULL, before touching cmd->scdatadirection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
Event History
Frequently Asked Questions
Which systems are exposed to this crash?
Systems using the Linux kernel qla2xxx driver with EDIF functionality are exposed when firmware can report a status completion for a SCSI command that has already been returned or aborted.
What must happen to trigger the issue?
The driver must process a status completion whose associated SCSI command pointer is NULL. The vulnerable RX SA delete check dereferences that pointer before the later status-path check can recognize that the command was already returned.
What is the impact of successful triggering?
The NULL pointer dereference crashes the kernel in interrupt context.
How can I tell whether this condition has occurred?
The related status path can log the message "Command already returned" when it re-fetches a NULL command pointer. In the vulnerable ordering, however, the earlier dereference may crash the kernel before that check is reached.