Strix
64.1K

CVE-2026-89863

HIGHCVSS 7.5/10

Last modified

CVE-2026-89863 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context. Return early when cmd is NULL, before touching cmd->sc_data_direction..

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context. Return early when cmd is NULL, before touching cmd->sc_data_direction.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= dd30706e73b70d67e88fdaca688db7a3374fd5de, < e479e9b148456905d12711411484b94083c8ff58; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < 2191b0034a2f1307d421782e6eceddf8eec9e7f6; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < de0c8ef3b900c5e971c82ef38c6f5c22c5f3d8c1; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < 96eb8a3fc9f7fe7ba32679fcf1d2fd7d251e7a8b; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < 94bfb61478bcb207d27f8cd24fd231421059519f; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < 75fd6d041c4a325ae37f4683e6678d3015988bb0; >= dd30706e73b70d67e88fdaca688db7a3374fd5de, < c20ee380ca59c5a8646750c4849969a815924e2e
LinuxLinux5.15

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89863?
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context. Return early when cmd is NULL, before touching cmd->sc_data_direction.
How severe is CVE-2026-89863?
CVE-2026-89863 has a CVSS score of 7.5/10 (HIGH severity).
How do I fix CVE-2026-89863?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89863?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST