https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 03:46:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-89854 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Fix cs84xx use-after-free on host teardown</p> <p>qla84xx_put_chip() drops the last reference to ha-&gt;cs84xx and frees it via __qla84xx_chip_release() without clearing ha-&gt;cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha-&gt;cs84xx, resulting in a use-after-free.</p> <p>Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Fix cs84xx use-after-free on host teardown</p> <p>qla84xx_put_chip() drops the last reference to ha-&gt;cs84xx and frees it via __qla84xx_chip_release() without clearing ha-&gt;cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha-&gt;cs84xx, resulting in a use-after-free.</p> <p>Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.</p> https://cve.radiocsirt.org/vuln/cve-2026-89854