CVE-2026-89846 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len:
if (IS_FWI2_CAPABLE(ha)) {
sense_data += rsp_info_len; par_sense_len -= rsp_info_len; }
rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds.
The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense():
if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len);
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer.
Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's QLogic Fibre Channel driver (qla2xxx) represents a critical out-of-bounds read condition rooted in improper input validation of data received from external hardware targets. Specifically, within the qla2x00_status_entry function, the code processes firmware interface version 2 status entries by adjusting pointers and lengths based on information provided directly by the target device. The driver retrieves rsp_info_len, a thirty-two-bit value corresponding to sf.rsp_data_len from the FCP response, which indicates the length of additional sense data appended to the standard SCSI sense buffer. This value is used to advance the sense_data pointer forward and simultaneously reduce par_sense_len, which represents the maximum allowable size for the IOCB data area. For 24xx series adapters this limit is twenty-eight bytes, while for 29xx series it is sixty bytes. The fundamental flaw lies in the assumption that rsp_info_len will always be less than or equal to par_sense_len. When a malicious or malfunctioning target reports an rsp_info_len value exceeding these limits, the unsigned integer subtraction causes par_sense_len to underflow, resulting in a massive positive number due to wrap-around behavior inherent in unsigned arithmetic operations.
This underflowed length effectively disables the subsequent bounds checking logic within qla2x00_handle_sense. The driver attempts to cap sense_len against par_sense_len before copying data into the command's sense buffer using memcpy. However, because par_sense_len has wrapped around to a huge value, this check fails to restrict the copy operation appropriately. Consequently, the kernel proceeds to read up to SCSI_SENSE_BUFFERSIZE bytes from the now-invalidated sense_data pointer. Since sense_data was advanced by an excessive amount based on the unvalidated rsp_info_len, it points well beyond the allocated IOCB data area into adjacent memory regions. This results in a direct out-of-bounds read that exposes sensitive kernel heap or response-ring memory contents to userspace via the SCSI error handling path. The impact is primarily information disclosure, allowing local attackers with access to block devices managed by this driver to leak kernel memory contents, which can facilitate further exploitation techniques such as address leakage for bypassing KASLR protections.
From a classification perspective, this vulnerability aligns closely with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Read. The root cause is the failure to validate external input before performing arithmetic operations that depend on safe bounds, leading to an invalid memory access pattern. In terms of attack vectors, this falls under ATT&CK technique T1530 Data from Local System, specifically involving data staging through kernel memory reads. An attacker would typically need physical or logical access to the system and control over a connected storage target to trigger this condition by sending crafted FCP responses with oversized rsp_info_len fields. The exploitation does not require privilege escalation initially but provides critical information that can be leveraged for higher-impact attacks against the host operating system.
The remediation strategy implemented in the kernel involves clamping rsp_info_len to par_sense_len prior to performing the subtraction operation. By ensuring that rsp_info_len never exceeds the maximum allowable size of the IOCB data area, the driver guarantees that par_sense_len will remain non-negative and within valid bounds after adjustment. This fix is applied before the completion status switch statement, thereby covering both call sites for qla2x00_handle_sense and preventing the out-of-bounds read in all relevant code paths. To mitigate this risk on systems where immediate patching may not be feasible, administrators should ensure that only trusted storage targets are connected to hosts running affected kernel versions. Additionally, implementing strict network segmentation or physical access controls can reduce the attack surface by limiting exposure to potentially hostile hardware devices. Regular updates of the Linux kernel and associated drivers remain the most effective defense against such low-level memory safety vulnerabilities in device drivers.