{"id":24548,"date":"2026-09-16T20:32:27","date_gmt":"2026-09-16T12:32:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89861"},"modified":"2026-09-16T20:32:27","modified_gmt":"2026-09-16T12:32:27","slug":"cve-2026-89861","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89861","title":{"rendered":"CVE-2026-89861 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold v"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()<\/p>\n<p>In the format 1 path, the virtual port is located on ha-&gt;vp_list while<br \/>\nholding vport_slock, but the lock is dropped before vp is used:<br \/>\nqla_update_host_map() is called and VP_IDX_ACQUIRED\/REGISTER_FC4_NEEDED\/<br \/>\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that<br \/>\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport<br \/>\ndown and free it, leading to a use-after-free.<\/p>\n<p>Take a vport reference (vref_count) under vport_slock when the matching<br \/>\nvp is found, and drop it after the last use of<br \/>\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before<br \/>\nunlinking and freeing the vport, so the pointer stays valid. This<br \/>\nmatches the reference idiom already used by the other ha-&gt;vp_list<br \/>\ntraversals.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()<\/p>\n<p>In the format 1 path, the virtual port is located on ha-&gt;vp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24548","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}