SB20260917113 - Type Confusion in Linux kernel scsi qla2xxx driver
Published: September 17, 2026
Security Bulletin ID
SB20260917113
CSH Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Type Confusion (CVE-ID: CVE-2026-89849)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a wild pointer dereference.
The vulnerability exists due to type confusion in the qla2x00_status_entry() SCSI fast path when processing an unexpected STATUS_TYPE IOCB for a non-SCSI handle. A remote attacker can cause an unexpected STATUS_TYPE IOCB for a non-SCSI handle to be processed to cause a wild pointer dereference.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0f41d07d72f2245208c45374ca8d0a1846cad667
- https://git.kernel.org/stable/c/29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9
- https://git.kernel.org/stable/c/8f0e31e7a41376abe7d6ca7cbee07fcf9de071e6
- https://git.kernel.org/stable/c/9204fb0888374083be74f799049649a17eab4191
- https://git.kernel.org/stable/c/b7418198b45b327194b97f856fe8ea8daa91f3fd
- https://git.kernel.org/stable/c/e38041b47c29316ba79b645e2ae0b713d216b1db
- https://git.kernel.org/stable/c/e93aa3c5125d9a4352ac0fa8ba4a7f8f87881805