# scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

CVE record · `CVE-2026-89861`

- **Identifiers:** `CVE-2026-89861`
- **State:** Confirmed
- **Severity:** CVSS 8.1 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 16 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before d09ef32af1e05d79f29b460521a20bc4e6fd2ecf` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 267533b28ddf2c9223d30ad7e6960fa9e936428e` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before f8d2eb510c063a8ca79a5dc766a4303d3925fe83` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 47272152a13d202d98496208f9bf382c1cf4d4fb` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before d556f899964d184e6cb788f3fa9dcddcafe1ab2d` (git)
  - affected: `2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 793cedee296fd819bfadc2a7ec4d52faf9c09a0a` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `2.6.23`
  - unaffected: `before 2.6.23` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.51 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.5 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.1 High, CVSS 3.1: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0059, the 48th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89861](https://www.cve.org/CVERecord?id=CVE-2026-89861)
- [NVD: CVE-2026-89861](https://nvd.nist.gov/vuln/detail/CVE-2026-89861)

### References from the CNA

- <https://git.kernel.org/stable/c/d09ef32af1e05d79f29b460521a20bc4e6fd2ecf>
- <https://git.kernel.org/stable/c/4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69>
- <https://git.kernel.org/stable/c/267533b28ddf2c9223d30ad7e6960fa9e936428e>
- <https://git.kernel.org/stable/c/f8d2eb510c063a8ca79a5dc766a4303d3925fe83>
- <https://git.kernel.org/stable/c/f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297>
- <https://git.kernel.org/stable/c/47272152a13d202d98496208f9bf382c1cf4d4fb>
- <https://git.kernel.org/stable/c/d556f899964d184e6cb788f3fa9dcddcafe1ab2d>
- <https://git.kernel.org/stable/c/793cedee296fd819bfadc2a7ec4d52faf9c09a0a>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89861>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89861/>. Everything for agents: <https://agentprime.io/llms.txt>.