CVE-2026-89848

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Quiesce response IRQ before freeing request queue

qla2xxx_delete_qpair() deletes the request queue before the response

queue. qla25xx_delete_req_que() frees the request queue memory

(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is

only released later, in qla25xx_free_rsp_que(). In that window the

response interrupt can still fire, qla2xxx_msix_rsp_q() queues

qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue()

dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the

status path), a use-after-free.

The cancel_work_sync() added for the qpair teardown lives in the

response free path, which runs after the request queue is already freed,

so it does not protect rsp->req.

Release the response-queue interrupt and flush qpair->q_work before

deleting the request queue, so no late completion can reach the freed

request queue. Clearing have_irq makes the subsequent

qla25xx_free_rsp_que() skip its free_irq(), and the firmware

queue-delete order (request then response) is preserved; the

request-delete mailbox completes on the default vector and is unaffected

by dropping the qpair response interrupt early.