AZL-101457
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101457.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-101457
- Upstream
- Published
- 2026-09-16T11:16:54Z
- Modified
- 2026-09-17T14:15:58Z
- Summary
- CVE-2026-89863 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction. That command pointer can be NULL: the firmware may post a status completion for a command that has already been returned or aborted. The caller qla2x00_status_entry() acknowledges this on the very same status path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command already returned" message when it is NULL -- but that check runs only after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the pointer, so a NULL cmd crashes the kernel in interrupt context.
Return early when cmd is NULL, before touching cmd->sc_data_direction.
- References