CVE-2026-89858 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates
list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp().
Reject requests whose declared count does not fit in the buffer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel driver for QLogic Fibre Channel adapters contains a critical out-of-bounds read vulnerability within the qla2xxx subsystem, specifically affecting the function responsible for updating firmware revision control unit versions. This flaw arises from an insufficient validation of user-supplied input during the processing of Block Storage Group requests. When handling these requests, the driver allocates a fixed-size stack buffer with a capacity defined by DMA_POOL_SIZE, which amounts to 256 bytes. The code proceeds to copy data provided by the user into this static buffer and subsequently attempts to iterate through an array of image version structures embedded within that same memory space.
The core technical deficiency lies in the lack of bounds checking for the iteration count supplied by the user application. The variable controlling the number of iterations, list->count, is extracted directly from the incoming request without any upper limit verification relative to the actual size of the destination buffer. Mathematical analysis reveals that given the fixed buffer size and the structure overhead required to store the count itself, only six instances of the qla_image_version structure can physically fit within the allocated memory space. However, because the driver does not validate whether the requested count exceeds this physical limit, it allows values significantly larger than six to be processed without triggering an error condition.
This unchecked iteration leads directly to a stack-based buffer over-read scenario. As the loop progresses beyond the sixth entry, the pointer advancing through the qla_image_version array moves past the boundaries of the allocated bsg buffer and into adjacent regions of kernel stack memory. This constitutes an out-of-bounds read vulnerability where sensitive information residing in other parts of the kernel's execution context is exposed to the driver logic. The compromised data is then passed to the function responsible for writing Small Form-factor Pluggable module details, effectively leaking internal kernel state through hardware interfaces that may be accessible or observable by external entities depending on the specific adapter configuration and operational mode.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read, as it involves accessing memory locations beyond the intended buffer boundary. It also relates to CWE-20, Improper Input Validation, due to the failure to enforce constraints on user-controlled data before processing. In terms of attack vectors and techniques, this flaw can be leveraged for information disclosure, potentially mapping into ATT&CK technique T1083, File and Directory Discovery, if the leaked stack contents reveal paths or filenames, or more broadly as part of an Information Leak (T1561) scenario where kernel memory dumps are extracted to aid in further exploitation such as bypassing kernel address space layout randomization.
The operational impact of this vulnerability is primarily centered on confidentiality and potential system stability issues depending on the contents read from adjacent stack frames. An attacker with local access who can trigger BSG commands against the affected QLogic adapter could potentially extract sensitive kernel data, including pointers to other functions or variables that might facilitate privilege escalation attacks in subsequent stages. While the immediate effect is an information leak, the exposure of internal memory layouts significantly lowers the barrier for advanced exploitation techniques targeting the Linux kernel environment.
To mitigate this risk, it is imperative to enforce strict bounds checking on all user-supplied counts before they are used to control array iterations or buffer accesses. The qla2x00_update_fru_versions function must verify that the declared count does not exceed the maximum number of entries that can physically reside within the DMA_POOL_SIZE buffer after accounting for structural overheads. Implementing this validation ensures that any request attempting to read beyond the allocated stack space is rejected early in the processing pipeline, thereby preventing the out-of-bounds memory access and preserving the integrity of kernel stack data.