{"id":"CVE-2026-89845","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL\ncheck and again when assign…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL\ncheck and again when assign…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < c845f2597787ef70159a32566669e308b2807a56","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < fe04b31e386aee4cc3a18f07462af146037dc389","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < 1b995cf4157465357d66ba096e7cdaafab9972e7","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < d79376fbd2a076de82c1cd8aa0b600b300c75a44","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < 1c90b74e484ba48f31944fe04963d99e01ac3767","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < 5dd9bec8004ba93cee8b689bf54ce294f59e5e3c","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < 35124cfa9898b2088ee72859e573e0876aff66fc","Linux >= a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b < deb8abde83a799d2501f3977f6d6051000253f5e","Linux 3.4"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:16:51.720","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89845","references":[{"url":"https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.996Z","epss":0.00211,"epssPercentile":0.11596,"slug":"CVE-2026-89845","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL\ncheck and again when assigning it to req. The map slot is cleared by\nqla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)\nduring queue teardown, while the response-queue interrupt that drives\nqla2x00_error_entry() is still registered (the IRQ is released later in\nqla25xx_free_rsp_que()). If the slot is set to NULL between the two\nreads, req becomes NULL and is dereferenced.\n\nRead the slot once into req and NULL-check the local before use. mq_lock\nis a mutex and cannot be taken from interrupt context, so the single\nread plus local check is the appropriate fix for the reported NULL\ndereference.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}