CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Initialize NVMe abort_work once at submission

qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on

priv->abort_work immediately before schedule_work(). INIT_WORK()

reinitializes the work_struct, resetting its list head and clearing the

pending bit. If an abort is issued more than once for the same command

(for example, concurrent transport teardown and a timeout-driven abort),

the second INIT_WORK() reinitializes a work item that is already queued,

which can corrupt the workqueue list and lead to crashes or a looping

worker.

Initialize priv->abort_work once at command submission, next to the

existing per-command spin_lock_init(&priv->cmd_lock), and leave only

schedule_work() in the abort paths. schedule_work() already does nothing

when the work item is still pending, so a repeated abort no longer

disturbs an in-flight work item. The command is not returned to the

transport until the final kref_put()/release callback runs after

abort_work has completed, so the work item is idle before priv is reused

and the single submission-time INIT_WORK() is safe.