---
id: CVE-2026-89863
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

  qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
  GET_CMD_SP(sp) and immediately deref…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

  qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
  GET_CMD_SP(sp) and immediately deref…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    e479e9b148456905d12711411484b94083c8ff58
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    2191b0034a2f1307d421782e6eceddf8eec9e7f6
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    94bfb61478bcb207d27f8cd24fd231421059519f
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    75fd6d041c4a325ae37f4683e6678d3015988bb0
  - >-
    Linux >= dd30706e73b70d67e88fdaca688db7a3374fd5de <
    c20ee380ca59c5a8646750c4849969a815924e2e
  - Linux 5.15
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:14.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89863'
references:
  - url: 'https://git.kernel.org/stable/c/2191b0034a2f1307d421782e6eceddf8eec9e7f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/75fd6d041c4a325ae37f4683e6678d3015988bb0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94bfb61478bcb207d27f8cd24fd231421059519f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c20ee380ca59c5a8646750c4849969a815924e2e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e479e9b148456905d12711411484b94083c8ff58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.992Z'
epss: 0.007
epssPercentile: 0.51073
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction.
That command pointer can be NULL: the firmware may post a status
completion for a command that has already been returned or aborted.  The
caller qla2x00_status_entry() acknowledges this on the very same status
path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command
already returned" message when it is NULL -- but that check runs only
after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the
pointer, so a NULL cmd crashes the kernel in interrupt context.

Return early when cmd is NULL, before touching cmd->sc_data_direction.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.