CVE-2026-89845: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-rgjv-6vw7-qf84
Share
Published
Advisory Summary

CVE-2026-89845 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89845 at a Glance

CVE Identifier CVE-2026-89845
GHSA Identifier GHSA-rgjv-6vw7-qf84
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89845

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89845, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.

References

NVD — CVE-2026-89845 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89845
git.kernel.org/stable/c/1b995cf415... WEB
https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7
git.kernel.org/stable/c/1c90b74e48... WEB
https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767
git.kernel.org/stable/c/35124cfa98... WEB
https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc
git.kernel.org/stable/c/5dd9bec800... WEB
https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c
git.kernel.org/stable/c/c845f25977... WEB
https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56
git.kernel.org/stable/c/d79376fbd2... WEB
https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44
git.kernel.org/stable/c/deb8abde83... WEB
https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e
git.kernel.org/stable/c/fe04b31e38... WEB
https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389

Frequently Asked Questions

What is CVE-2026-89845?
CVE-2026-89845 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89845?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89845?
CVE-2026-89845 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89845?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rgjv-6vw7-qf84",
  "modified" : "2026-09-16T12:30:38Z",
  "published" : "2026-09-16T12:30:38Z",
  "aliases" : [ "CVE-2026-89845" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()\n\nqla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL\ncheck and again when assigning it to req. The map slot is cleared by\nqla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)\nduring queue teardown, while the response-queue interrupt that drives\nqla2x00_error_entry() is still registered (the IRQ is released later in\nqla25xx_free_rsp_que()). If the slot is set to NULL between the two\nreads, req becomes NULL and is dereferenced.\n\nRead the slot once into req and NULL-check the local before use. mq_lock\nis a mutex and cannot be taken from interrupt context, so the single\nread plus local check is the appropriate fix for the reported NULL\ndereference.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89845"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:16:51Z"
  }
}