CVE-2026-89843 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) and fill it via
sg_copy_to_buffer(), which only copies as many bytes as the user-supplied request payload. When the request is shorter than the structure, the remainder of the buffer is left holding stale stack data.
qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full structure back to the reply payload with sg_copy_from_buffer(), leaking the uninitialized stack bytes to user space. The write/update paths do not copy the buffer back, but can feed uninitialized fields to the device.
Zero the stack buffer at declaration in all five handlers, mirroring the heap kzalloc() approach, so short requests can no longer expose stale memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified within the qla2xxx SCSI driver represents a classic information disclosure flaw rooted in improper initialization of local variables on the stack. The core technical issue lies in how several Block Layer SCSI (bsg) handlers manage their request and reply buffers. Specifically, these functions allocate an uninitialized 256-byte buffer on the kernel stack to stage data for communication with hardware devices. When a user-space application submits a request that is shorter than the full size of this internal structure, the driver utilizes sg_copy_to_buffer() to populate only the portion corresponding to the actual payload. This operation leaves the remaining bytes in the 256-byte buffer untouched, preserving whatever stale data previously existed at those memory addresses on the stack.
This uninitialized state creates a direct pathway for sensitive kernel information leakage when the handler proceeds to process the request and prepare the response. Functions such as qla2x00_read_fru_status() and qla2x00_read_i2c() are responsible for copying data from this internal buffer back to the user-space reply payload using sg_copy_from_buffer(). Because these copy operations typically operate on fixed sizes or assume complete initialization, they inadvertently include the uninitialized stack bytes in the output sent to the application. This results in a kernel-to-user information leak, where an attacker can potentially read arbitrary memory contents from the kernel stack by crafting requests of specific lengths that trigger this partial fill and subsequent full copy behavior.
Beyond simple data leakage, the vulnerability also poses risks related to operational integrity and potential exploitation for further attacks. While the write or update paths do not immediately return uninitialized data to user space, they can feed these uninitialized fields directly to the hardware device. This introduces a risk of undefined behavior at the driver level, potentially leading to unpredictable device states or crashes if the hardware interprets garbage stack values as valid commands or parameters. Furthermore, leaking kernel stack contents aids attackers in bypassing security mitigations such as Kernel Address Space Layout Randomization (KASLR) by revealing memory addresses that can be used for subsequent exploitation steps.
From a classification perspective, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-457: Use of Uninitialized Variable. In the context of the MITRE ATT&CK framework, this flaw facilitates information discovery techniques where adversaries gather system state data to plan further intrusions. The root cause is a failure in secure coding practices regarding memory management within kernel-space drivers, specifically neglecting to ensure that all allocated buffers are zeroed out before use or after partial population.
The resolution implemented involves modifying the five affected bsg handlers to explicitly zero-initialize the stack buffer at the point of declaration. This approach mirrors the standard practice used for heap-allocated buffers via kzalloc(), ensuring that any portion of the buffer not overwritten by the user-supplied payload is set to null bytes rather than retaining stale data. By enforcing this initialization, the driver guarantees that short requests do not expose residual kernel memory contents during the reply phase. This fix effectively closes the information leak vector and prevents uninitialized values from being passed to hardware devices, thereby restoring both confidentiality and operational stability for systems relying on qla2xxx storage adapters. Administrators should ensure their kernels are updated with this patch applied to mitigate the risk of local privilege escalation or sensitive data exposure through SCSI interface interactions.