Answer in brief
CVE-2026-89854 records a Unknown severity vulnerability in scsi: qla2xxx: Fix cs84xx use-after-free on host teardown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <8c1ebcade6aac58137f2645b579894301febabf3 || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <1d8bbc4344b9367d9d54731475d745fbc9ea28f2 || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <2c3b17ee53f034936f7398dbf4d143e608b7c35c || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <ae09260be7454ed7630a913f147591a25e3a9d09 || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <fcf0804dfe05862007189ac9dc4dc2063be36de1 || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <8286a9095fb59751fba171afa2b4f590271c87d5 || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <122bf170c94a3797531b12fee580639a5dc893ed || >=fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <33d102102d925357c5fd172dd6672a27d74b3215 | 8c1ebcade6aac58137f2645b579894301febabf3, 1d8bbc4344b9367d9d54731475d745fbc9ea28f2, 2c3b17ee53f034936f7398dbf4d143e608b7c35c, ae09260be7454ed7630a913f147591a25e3a9d09, fcf0804dfe05862007189ac9dc4dc2063be36de1, 8286a9095fb59751fba171afa2b4f590271c87d5, 122bf170c94a3797531b12fee580639a5dc893ed, 33d102102d925357c5fd172dd6672a27d74b3215 |
| Linux/Linuxgeneric | 3.14 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free. Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
Quoted source text, attributed separately from HOL analysis.