CVE-2026-89852 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then
unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's
states[] array regardless of the return value.
On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's qla2xxx SCSI driver represents a classic instance of an uninitialized memory exposure, specifically categorized under CWE-908 as Use of Uninitialized Resource. The core technical flaw resides within the function qla2x00_get_firmware_state(), which interacts with hardware via mailbox commands to retrieve firmware state information. During this process, a structure of type mbx_cmd_t is allocated on the kernel stack and passed to qla2x00_mailbox_command() for execution. This command interface serves as the primary mechanism for host bus adapters to communicate with their onboard processors, requiring careful handling of input and output parameters to ensure data integrity and security.
The critical defect arises from the control flow within qla2x00_mailbox_command(). Under specific failure conditions such as a permanent PCI error, device unavailability, Enhanced Error Handling busy states, pending ISP aborts, mailbox access timeouts, or active purges of the mailbox queue, the function executes early return paths. These code branches exit the function without populating the input mailbox registers back into the mcp->mb array. Consequently, when qla2x00_get_firmware_state() proceeds to copy data from indices one through six and index twelve of this structure into a caller-supplied states array, it is copying raw, uninitialized kernel stack memory rather than valid hardware state information. This behavior creates a direct pathway for sensitive kernel memory contents to be exposed outside the privileged execution context.
The operational impact of this vulnerability is significant due to its potential for information disclosure and system instability. The corrupted or random data copied from the stack is subsequently exposed to userspace through sysfs handlers named fw_state and mpi_fw_state. Userspace applications reading these attributes can inadvertently retrieve portions of kernel memory that may contain cryptographic keys, authentication tokens, pointers to other kernel structures, or sensitive configuration details. This aligns with ATT&CK technique T1083, which involves File and Directory Discovery, as attackers could leverage this information leak to map the internal state of the system for further exploitation. Furthermore, if userspace logic relies on these values for decision-making without proper validation, it could lead to undefined behavior or application crashes within user-space processes that interact with storage subsystems.
To mitigate this vulnerability and restore secure operation, the primary remediation involves ensuring deterministic initialization of all memory structures before they are exposed to less privileged contexts. The specific fix implemented in the kernel addresses this by zeroing out the mailbox structure prior to its use or immediately after allocation if it is not fully populated during a successful command execution path. This ensures that any early returns from qla2x00_mailbox_command() result in a states array filled with zeros rather than arbitrary stack contents. Beyond this specific patch, developers should adhere to strict memory initialization practices for all structures passed across privilege boundaries or exposed via sysfs interfaces. Implementing static analysis tools and code reviews focused on uninitialized variable usage can help prevent similar defects in future development cycles, ensuring that kernel subsystems maintain robust isolation from userspace access vectors.