# CVE-2026-89847

Use-after-free in Linux qla2xxx SCSI driver enabling kernel crash or privilege escalation.

- Page: https://www.vulneraibility.com/cve/CVE-2026-89847
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.69% (percentile 53.0)
- Published: 2026-09-16

## Affected versions

- Linux: affected >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < 71a7b6e3c7f121439f51a058e53d4a8e05b63dec; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < 7257b5e1fb6c9387714f66e01b79ec82b717eede; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < f5b660e0b0d9190d8853c795c2522cc5f8c93003; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < 6e217a9482eabbd8b29847be334c74cf468d3544; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < d6d856c722f40f0694ff755208552e658db6dd42; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < 9fa1d71233a82416492d9c9de9756ebe140fe714; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < 845d4abd92cd2f97551356c8b281ad6e197acb07; >= f6145e86d21fccd59bbb87bc1e1eb076658fd79a and < bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8; 4.19; fixed in < 4.19, >= 5.10.270 and <= 5.10.*, >= 5.15.221 and <= 5.15.*, >= 6.1.188 and <= 6.1.*, >= 6.6.157 and <= 6.6.*, >= 6.12.110 and <= 6.12.*, >= 6.18.51 and <= 6.18.*, >= 7.2.5 and <= 7.2.*, >= 7.3-rc1 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Use-after-free in qla2xxx can cause kernel memory corruption leading to local privilege escalation or kernel panic via crafted IOCB/timeouts.

## Action

Patch when possible

## Recommendation

Install vendor/ upstream kernel update for qla2xxx and reboot affected hosts immediately.

## References

- [other] https://git.kernel.org/stable/c/71a7b6e3c7f121439f51a058e53d4a8e05b63dec
- [other] https://git.kernel.org/stable/c/7257b5e1fb6c9387714f66e01b79ec82b717eede
- [other] https://git.kernel.org/stable/c/f5b660e0b0d9190d8853c795c2522cc5f8c93003
- [other] https://git.kernel.org/stable/c/6e217a9482eabbd8b29847be334c74cf468d3544
- [other] https://git.kernel.org/stable/c/d6d856c722f40f0694ff755208552e658db6dd42
- [other] https://git.kernel.org/stable/c/9fa1d71233a82416492d9c9de9756ebe140fe714
- [other] https://git.kernel.org/stable/c/845d4abd92cd2f97551356c8b281ad6e197acb07
- [other] https://git.kernel.org/stable/c/bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.