Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89861

scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

CVSS 8.1 HighEPSS 0.0059 · 48th percentile

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before d09ef32af1e05d79f29b460521a20bc4e6fd2ecf git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 4b7f0a95bfeb1d3673da4c29bbe9872a61bc1a69 git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 267533b28ddf2c9223d30ad7e6960fa9e936428e git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before f8d2eb510c063a8ca79a5dc766a4303d3925fe83 git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before f6b3bcc7cb2f4c37464958b9fd97dc7f185ea297 git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 47272152a13d202d98496208f9bf382c1cf4d4fb git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before d556f899964d184e6cb788f3fa9dcddcafe1ab2d git
  • affected 2c3dfe3f6ad8daff5acdb01713e4f2b116e78136 to before 793cedee296fd819bfadc2a7ec4d52faf9c09a0a git
Other versions: unaffected
Linux Linux
  • affected 2.6.23
  • unaffected before 2.6.23 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.110 to 6.12.*, inclusive semver
  • unaffected 6.18.51 to 6.18.*, inclusive semver
  • unaffected 7.2.5 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89861
CNA
Linux
Tags
Published
16 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.1 High 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0059, the 48th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.