Threats tagged 'ghsa-c5f6-cp2c-vcqc'

CVE-2026-89848 is a use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver. The flaw occurs because the request queue is freed before the response queue interrupt is released, allowing a response interrupt to access freed memory. This can lead to high-impact consequences including confidentiality, integrity, and availability compromises. The vulnerability has a high CVSS score of 8.1. The fix involves releasing the response-queue interrupt and flushing queued work before deleting the request queue to prevent late completions from accessing freed memory.