1. Home
  2. Vulnerabilities
  3. CVE-2026-89850
0.0
NA
CVE-2026-89850
scsi: qla2xxx: Don't query firmware state while chip is down
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt. Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.

Details
INFO

Published Date :

Sept. 16, 2026, 11:16 a.m.

Last Modified :

Sept. 16, 2026, 11:16 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-89850 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Update Linux kernel to prevent adapter hangs during reset or error recovery.
  • Update the Linux kernel to the latest version.
  • Apply patches addressing qla2xxx firmware state handling.
  • Ensure the chip is up and not EEH-busy before issuing commands.
  • Mark firmware state as unknown on errors.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-89850.

URL Resource
https://git.kernel.org/stable/c/178d984e8875292582e4295cf559b2b11d3c9325
https://git.kernel.org/stable/c/22f44f77da496bc355479c08a0a9dbc9ad42ba42
https://git.kernel.org/stable/c/7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749
https://git.kernel.org/stable/c/a194684853dceaa1d6b7a9a02bc12f479232ad9b
https://git.kernel.org/stable/c/a6374b508893de15fee78583a95f5099d7812e85
https://git.kernel.org/stable/c/b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d
https://git.kernel.org/stable/c/cba780c01f72f8585ca81ad7304097f8b12ef339
https://git.kernel.org/stable/c/e0cebe20dcffbed9c078fe30e2d18cd5046d9eff
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-89850 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-89850 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-89850 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-89850 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Sep. 16, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt. Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.
    Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89850.json">CVE-2026-89850</a>
    Added Reference https://git.kernel.org/stable/c/178d984e8875292582e4295cf559b2b11d3c9325
    Added Reference https://git.kernel.org/stable/c/22f44f77da496bc355479c08a0a9dbc9ad42ba42
    Added Reference https://git.kernel.org/stable/c/7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749
    Added Reference https://git.kernel.org/stable/c/a194684853dceaa1d6b7a9a02bc12f479232ad9b
    Added Reference https://git.kernel.org/stable/c/a6374b508893de15fee78583a95f5099d7812e85
    Added Reference https://git.kernel.org/stable/c/b6a30baa29695fa0eaba4a3a04435a3c1a5cb63d
    Added Reference https://git.kernel.org/stable/c/cba780c01f72f8585ca81ad7304097f8b12ef339
    Added Reference https://git.kernel.org/stable/c/e0cebe20dcffbed9c078fe30e2d18cd5046d9eff
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.