CVE-2026-89853

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

qla2x00_free_fce_trace() freed and cleared ha->fce while holding only

fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and

qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the

buffer) under hardware_lock and never take fce_mutex. A debugfs FCE

disable could therefore free the DMA buffer between a dump's NULL check

and its copy, resulting in a use-after-free.

Unpublish ha->fce under hardware_lock, then release the lock and free

the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either

completes its check and copy with the buffer still valid, or observes

ha->fce == NULL and skips it.