{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-89861",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-89861"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()\n\nIn the format 1 path, the virtual port is located on ha->vp_list while\nholding vport_slock, but the lock is dropped before vp is used:\nqla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/\nREGISTER_FDMI_NEEDED are set on vp. No reference is taken across that\nwindow, so a concurrent qla24xx_deallocate_vp_id() can tear the vport\ndown and free it, leading to a use-after-free.\n\nTake a vport reference (vref_count) under vport_slock when the matching\nvp is found, and drop it after the last use of\nvp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before\nunlinking and freeing the vport, so the pointer stays valid. This\nmatches the reference idiom already used by the other ha->vp_list\ntraversals.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89861"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z"
  }
}