{"id":"CVE-2026-89863","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check\n\nqla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via\nGET_CMD_SP(sp) and immediately deref…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check\n\nqla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via\nGET_CMD_SP(sp) and immediately deref…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < e479e9b148456905d12711411484b94083c8ff58","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < 2191b0034a2f1307d421782e6eceddf8eec9e7f6","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < 96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < 94bfb61478bcb207d27f8cd24fd231421059519f","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < 75fd6d041c4a325ae37f4683e6678d3015988bb0","Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de < c20ee380ca59c5a8646750c4849969a815924e2e","Linux 5.15"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:14.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89863","references":[{"url":"https://git.kernel.org/stable/c/2191b0034a2f1307d421782e6eceddf8eec9e7f6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75fd6d041c4a325ae37f4683e6678d3015988bb0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94bfb61478bcb207d27f8cd24fd231421059519f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c20ee380ca59c5a8646750c4849969a815924e2e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e479e9b148456905d12711411484b94083c8ff58","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.992Z","epss":0.0067,"epssPercentile":0.50551,"slug":"CVE-2026-89863","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check\n\nqla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via\nGET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction.\nThat command pointer can be NULL: the firmware may post a status\ncompletion for a command that has already been returned or aborted.  The\ncaller qla2x00_status_entry() acknowledges this on the very same status\npath, re-fetching GET_CMD_SP(sp) and bailing out with the \"Command\nalready returned\" message when it is NULL -- but that check runs only\nafter qla_chk_edif_rx_sa_delete_pending() has already dereferenced the\npointer, so a NULL cmd crashes the kernel in interrupt context.\n\nReturn early when cmd is NULL, before touching cmd->sc_data_direction.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":205178,"id":"CVE-2026-89863","ts":1789570705603,"field":"cvss","old":null,"new":"7.5"},{"seq":205177,"id":"CVE-2026-89863","ts":1789570705603,"field":"severity","old":"none","new":"high"}]}