CVE-2026-89850

scsi: qla2xxx: Don't query firmware state while chip is down

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Don't query firmware state while chip is down

qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS, defeating the chip-down/EEH-busy guards and issuing a mailbox command (outside optrom_mutex) during ISP reset or PCI error recovery, which can hang the adapter. It also turned a normal in-lock mailbox failure into a second unsynchronized mailbox attempt.

Make the out: fallback only mark the firmware state as unknown. The mailbox is now issued at most once, inside optrom_mutex, and only when the chip is up and not EEH-busy.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 178d984e8875292582e4295cf559b2b11d3c9325Affected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before cba780c01f72f8585ca81ad7304097f8b12ef339Affected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 22f44f77da496bc355479c08a0a9dbc9ad42ba42Affected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before b6a30baa29695fa0eaba4a3a04435a3c1a5cb63dAffected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749Affected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before a194684853dceaa1d6b7a9a02bc12f479232ad9bAffected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before a6374b508893de15fee78583a95f5099d7812e85Affected b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before e0cebe20dcffbed9c078fe30e2d18cd5046d9effAffected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 178d984e8875292582e4295cf559b2b11d3c9325Affected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before cba780c01f72f8585ca81ad7304097f8b12ef339Affected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 22f44f77da496bc355479c08a0a9dbc9ad42ba42Affected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before b6a30baa29695fa0eaba4a3a04435a3c1a5cb63dAffected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before 7bc2baed8a3d6a1e2a3f6b78d245f25d1e18a749Affected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before a194684853dceaa1d6b7a9a02bc12f479232ad9bAffected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before a6374b508893de15fee78583a95f5099d7812e85Affected
b6faaaf796d7bfb00e32ca5c905d55cc43e89448 to before e0cebe20dcffbed9c078fe30e2d18cd5046d9effAffected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.