---
id: CVE-2026-89854
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

  qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via
  __qla84xx_chip_release() without c…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

  qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via
  __qla84xx_chip_release() without c…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    8c1ebcade6aac58137f2645b579894301febabf3
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    1d8bbc4344b9367d9d54731475d745fbc9ea28f2
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    2c3b17ee53f034936f7398dbf4d143e608b7c35c
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    ae09260be7454ed7630a913f147591a25e3a9d09
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    fcf0804dfe05862007189ac9dc4dc2063be36de1
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    8286a9095fb59751fba171afa2b4f590271c87d5
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    122bf170c94a3797531b12fee580639a5dc893ed
  - >-
    Linux >= fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 <
    33d102102d925357c5fd172dd6672a27d74b3215
  - Linux 3.14
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:13.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89854'
references:
  - url: 'https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.993Z'
epss: 0.00171
epssPercentile: 0.05711
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via
__qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran
before scsi_remove_host(), which is what removes the 84xx_fw_version host
sysfs attribute. A concurrent read of that attribute in the window between
the two calls executes qla24xx_84xx_fw_version_show(), which dereferences
the freed ha->cs84xx, resulting in a use-after-free.

Move qla84xx_put_chip() to after scsi_remove_host() in both
qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once
scsi_remove_host() returns, the sysfs attribute is gone and kernfs has
drained any in-flight show(), so no reader can touch cs84xx; the put still
runs before the host and ha are freed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.