# CVE-2026-89857

qla2xxx kernel bug can corrupt NVMe‑FC request ring causing data loss/DoS

- Page: https://www.vulneraibility.com/cve/CVE-2026-89857
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.62% (percentile 49.6)
- Published: 2026-09-16

## Affected versions

- Linux: affected >= 875386b98857822b77ac7f95bdf367b70af5b78c and < 7eb618877503edbf17aa65e357a81bda1fc8f163; >= 875386b98857822b77ac7f95bdf367b70af5b78c and < b3a362466db6b8ec47cc537ac641ac197fa69b5d; >= 875386b98857822b77ac7f95bdf367b70af5b78c and < 11834e5773e20fd3742d7eb900876e66b9e7d029; >= 875386b98857822b77ac7f95bdf367b70af5b78c and < b02ff132017b28222187ebcf95ce7f4cb576cd36; >= 875386b98857822b77ac7f95bdf367b70af5b78c and < f743488e4a203049f27ec5d8cd0caccc483af01e; 6.6; fixed in < 6.6, >= 6.6.157 and <= 6.6.*, >= 6.12.110 and <= 6.12.*, >= 6.18.51 and <= 6.18.*, >= 7.2.5 and <= 7.2.*, >= 7.3-rc1 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Corrupts qla2xxx request ring leading to duplicated/dropped NVMe‑FC commands → storage data corruption, I/O loss, or host DoS.

## Action

Immediate action required

## Recommendation

Apply kernel updates containing the qla2xxx fix and reboot affected hosts; quiesce SAN I/O before update.

## References

- [other] https://git.kernel.org/stable/c/7eb618877503edbf17aa65e357a81bda1fc8f163
- [other] https://git.kernel.org/stable/c/b3a362466db6b8ec47cc537ac641ac197fa69b5d
- [other] https://git.kernel.org/stable/c/11834e5773e20fd3742d7eb900876e66b9e7d029
- [other] https://git.kernel.org/stable/c/b02ff132017b28222187ebcf95ce7f4cb576cd36
- [other] https://git.kernel.org/stable/c/f743488e4a203049f27ec5d8cd0caccc483af01e

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.