SB20260917114 - Improper locking in Linux kernel scsi qla2xxx driver
Published: September 17, 2026
Security Bulletin ID
SB20260917114
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper locking (CVE-ID: CVE-2026-89850)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in qla2x00_fw_state_show() when querying firmware state while the chip is down or EEH is busy. A local user can query the firmware state to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/178d984e8875292582e4295cf559b2b11d3c9325
- https://git.kernel.org/stable/c/22f44f77da496bc355479c08a0a9dbc9ad42ba42
- https://git.kernel.org/stable/c/7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749
- https://git.kernel.org/stable/c/a194684853dceaa1d6b7a9a02bc12f479232ad9b
- https://git.kernel.org/stable/c/a6374b508893de15fee78583a95f5099d7812e85
- https://git.kernel.org/stable/c/b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d
- https://git.kernel.org/stable/c/cba780c01f72f8585ca81ad7304097f8b12ef339
- https://git.kernel.org/stable/c/e0cebe20dcffbed9c078fe30e2d18cd5046d9eff