---
id: CVE-2026-89861
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

  In the format 1 path, the virtual port is located on ha->vp_list while
  holding vport_slock, but …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

  In the format 1 path, the virtual port is located on ha->vp_list while
  holding vport_slock, but …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    d09ef32af1e05d79f29b460521a20bc4e6fd2ecf
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    267533b28ddf2c9223d30ad7e6960fa9e936428e
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    f8d2eb510c063a8ca79a5dc766a4303d3925fe83
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    47272152a13d202d98496208f9bf382c1cf4d4fb
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    d556f899964d184e6cb788f3fa9dcddcafe1ab2d
  - >-
    Linux >= 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 <
    793cedee296fd819bfadc2a7ec4d52faf9c09a0a
  - Linux 2.6.23
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:13.917'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89861'
references:
  - url: 'https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.990Z'
epss: 0.00621
epssPercentile: 0.47647
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

In the format 1 path, the virtual port is located on ha->vp_list while
holding vport_slock, but the lock is dropped before vp is used:
qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/
REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that
window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport
down and free it, leading to a use-after-free.

Take a vport reference (vref_count) under vport_slock when the matching
vp is found, and drop it after the last use of
vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before
unlinking and freeing the vport, so the pointer stays valid. This
matches the reference idiom already used by the other ha->vp_list
traversals.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.