{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-89847",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-89847"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "scsi: qla2xxx: Avoid double completion in async IOCB timeout",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid double completion in async IOCB timeout\n\nqla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When\nqla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the\nSRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then\ncall sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking\nwhether the SRB was actually found and removed.\n\nIf the response ISR completes the same handle first, it removes the SRB\nunder qp_lock_ptr and runs sp->done() -> complete(sp->comp). The\nsubmitter qla24xx_control_vp() wakes from wait_for_completion(), clears\nsp->comp, drops its reference and returns, reclaiming the on-stack\ncompletion. The timer reference keeps the SRB alive across the timeout\nhandler, but not the submitter's stack. The timeout then issues a second\nsp->done() -> qla_ctrlvp_sp_done(), which evaluates \"if (sp->comp)\ncomplete(sp->comp)\"; with the pointer loaded before the submitter's NULL\nstore, complete() writes into the freed stack frame, a use-after-free.\n\nTrack whether this path removed the SRB from outstanding_cmds and only\ncall sp->done() when it did, so the command is completed exactly once by\nwhichever path owns it. This mirrors the sp_found guard already used in\nqla24xx_abort_iocb_timeout().",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89847"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/71a7b6e3c7f121439f51a058e53d4a8e05b63dec"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7257b5e1fb6c9387714f66e01b79ec82b717eede"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f5b660e0b0d9190d8853c795c2522cc5f8c93003"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6e217a9482eabbd8b29847be334c74cf468d3544"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d6d856c722f40f0694ff755208552e658db6dd42"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9fa1d71233a82416492d9c9de9756ebe140fe714"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/845d4abd92cd2f97551356c8b281ad6e197acb07"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z"
  }
}