Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2026-89845
Published: September 17, 2026
Vulnerability identifier: #VU150442
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89845
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a time-of-check to time-of-use race condition in qla2x00_error_entry() when handling error entries during request-queue teardown. A local user can trigger processing of an error entry while the request queue is being torn down to cause a denial of service.
The response-queue interrupt can remain registered while request queues are being torn down.
Affected software
Linux kernel
How to mitigate CVE-2026-89845
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7
- https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767
- https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc
- https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
- https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56
- https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44
- https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e
- https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389