# scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

CVE record · `CVE-2026-89853`

- **Identifiers:** `CVE-2026-89853`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 16 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `3a5a789494875376d1f8063ec5ecc6beafda2ce1 to before 423487f03e325b8665d20a2a3171fe012b1a4fa9` (git)
  - affected: `73d3d3c66f108bc47922490f8500842530139975 to before 7bd308cd893e8cce023d03a40a2f0adccaff0175` (git)
  - affected: `57c029cab0d908942e3ed9ff9fd0361144d01944 to before edc464a4fc96e2720d166e7cc7e7a6827b086760` (git)
  - affected: `217230bc8796a922d5b15a9a94ec4414b2d2b3e3 to before 6003e79148eca73d7cafb076f5be47e234d543d0` (git)
  - affected: `2cf3c3fe9a11aa168e80c966494c58548b9aed5d to before ef9b89f6c92274c3670403fd06130ca25f685050` (git)
  - affected: `841df27d619ee1f5ca6473e15227b39d6136562d to before 8e7a26931b6111583cfeaf49c068f26524dc3af2` (git)
  - affected: `841df27d619ee1f5ca6473e15227b39d6136562d to before 41ef7edde27ac87d55ffc703da44e78aa8c2e896` (git)
  - affected: `841df27d619ee1f5ca6473e15227b39d6136562d to before 53298efcbbb0f0438366d45cb7ed7e6d93dd5531` (git)
  - affected: `a89872a61b914378591f16e428dd221c5e2059b2` (git)
  - affected: `5.10.235 to before 5.10.270` (semver)
  - affected: `5.15.179 to before 5.15.221` (semver)
  - affected: `6.1.129 to before 6.1.188` (semver)
  - and 3 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `6.14`
  - unaffected: `before 6.14` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.51 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.5 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 12th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89853](https://www.cve.org/CVERecord?id=CVE-2026-89853)
- [NVD: CVE-2026-89853](https://nvd.nist.gov/vuln/detail/CVE-2026-89853)

### References from the CNA

- <https://git.kernel.org/stable/c/423487f03e325b8665d20a2a3171fe012b1a4fa9>
- <https://git.kernel.org/stable/c/7bd308cd893e8cce023d03a40a2f0adccaff0175>
- <https://git.kernel.org/stable/c/edc464a4fc96e2720d166e7cc7e7a6827b086760>
- <https://git.kernel.org/stable/c/6003e79148eca73d7cafb076f5be47e234d543d0>
- <https://git.kernel.org/stable/c/ef9b89f6c92274c3670403fd06130ca25f685050>
- <https://git.kernel.org/stable/c/8e7a26931b6111583cfeaf49c068f26524dc3af2>
- <https://git.kernel.org/stable/c/41ef7edde27ac87d55ffc703da44e78aa8c2e896>
- <https://git.kernel.org/stable/c/53298efcbbb0f0438366d45cb7ed7e6d93dd5531>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89853>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89853/>. Everything for agents: <https://agentprime.io/llms.txt>.