UBUNTU-CVE-2026-89844: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition() format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap() without the lock. That reaches qlaupdatevpmap(), which mutates the ha->hostmap btree via btreeinsert32()/btreeupdate32()/btreeremove32() and is documented to require vportslock to be held by the caller. Running it unlocked can race concurrent hostmap updates and corrupt the btree. The format-2 path in the same function already wraps its hostmap update (SETALPA) in vportslock; the format-1 path is the lone outlier. Hold vportslock across the format-1 qlaupdatehostmap() call to honor the documented locking contract. The vrefcount taken in the loop keeps the vport valid, so this only adds the missing hostmap serialization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Hold vport_slock across the format-1 qla_update_host_map() call in qla24xx_report_id_acquisition() to serialize host_map updates and prevent btree corruption.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected Ubuntu kernel packages listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop. The vulnerable code is in the qla2xxx SCSI driver, so exposure depends on use of that driver and its virtual-port host-map update path.
What conditions are needed to trigger the corruption?
A format-1 report ID acquisition must update a vport host map while another host-map update occurs concurrently. The unlocked update can race operations that insert, update, or remove entries in the host_map btree, potentially corrupting that btree.
What is the immediate mitigation if an updated kernel cannot be deployed?
The provided data does not identify a configuration workaround. The described fix is to ensure vport_slock is held across the format-1 qla_update_host_map() call, restoring serialization of host-map changes.