The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha->msix_count is u16, but     ha->max_req_queues, ha->max_rsp_queues and ha->max_qpairs are u8. Deriving the queue count as     ha->max_req_queues = ha->msix_count - 1 therefore truncates: a board (or a misconfigured/malicious hot-     plugged device) advertising 257 MSI-X vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X     count of 1 zeroes it as well, and in target mode the subsequent ha->max_req_queues-- then underflows 0     to 255. When the count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0), which returns     ZERO_SIZE_PTR. That is not NULL, so the allocation check passes and the following ha->req_q_map[0] = req     dereferences ZERO_SIZE_PTR, corrupting memory or crashing the kernel. Add qla_calc_queue_count() to clamp     the derived value into [1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and use it at     all three derivation sites (qla25xx_iospace_config(), qla83xx_iospace_config() and qla24xx_enable_msix()).
    Also guard the target-mode decrement so it cannot reintroduce a zero (which would in turn underflow     max_qpairs). (CVE-2026-89856)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89856

high Nessus Plugin ID 346478

Version 1.11

Version 1.10

Version 1.7

Version 1.4

Version 1.2

Version 1.1

Version 1.11 Oct 22, 2026, 10:08 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-89856, severity increased from "Medium" to "High") Plugin Feed: 202610221008
Version 1.10 Oct 22, 2026, 12:02 AM CVSS metrics ("CVSSv2 score" set to 6.8. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C". "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C") CVSSv2 severity (based on CVE-2026-89856, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.7 Sep 30, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.4 Sep 18, 2026, 2:17 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-89856, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609181417
Version 1.2 Sep 18, 2026, 12:24 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C") CVSSv2 severity (based on CVE-2026-89856, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609180024
Version 1.1 Sep 17, 2026, 12:32 PM New Plugin Feed: 202609171232