CVE-2026-89864 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
struct qla_i2c_access carries a 16-bit length field alongside a fixed 64-byte buffer:
struct qla_i2c_access {
uint16_t device, offset, option, length; uint8_t buffer[0x40];
} __packed;
qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. i2c is overlaid on a 256-byte on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to 65535 overruns both:
- write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs i2c->length bytes out of the 256-byte buffer. - read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp, then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte buffer inside the on-stack array.
A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the kernel stack. Reject requests whose length exceeds the buffer before any copy or DMA transfer in both handlers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel driver for QLogic Fibre Channel adapters, specifically qla2xxx, contained a critical input validation flaw within its I2C block device interface handlers. The vulnerability stems from the struct qla_i2c_access structure which includes a 16-bit length field and a fixed-size buffer of sixty-four bytes. When user-space applications interact with this driver via ioctl calls to read or write Serial Presence Detect data on SFP modules, the kernel functions qla2x00_write_i2c and qla2x00_read_i2c utilize the user-supplied length value without performing any bounds checking against the actual size of the destination buffers. This lack of validation allows an attacker to specify a length value significantly larger than the allocated memory regions, leading to severe memory corruption issues that compromise kernel integrity.
The technical mechanics of this vulnerability involve two distinct attack vectors corresponding to read and write operations. In the case of a write operation, the driver copies data from the user-supplied buffer into a 256-byte DMA-pool buffer named sfp using memcpy with the unchecked length parameter. If the specified length exceeds sixty-four bytes, the copy overflows the fixed-size buffer within the qla_i2c_access structure on the kernel stack and subsequently corrupts the heap-allocated sfp buffer. Following this corrupted state, the driver proceeds to perform a Direct Memory Access operation that transfers data out of the compromised 256-byte buffer, potentially exposing sensitive kernel memory or causing system instability. Conversely, during a read operation, the driver first performs a DMA transfer into the 256-byte sfp buffer and then copies this data back into the user-supplied buffer on the stack. Here, an oversized length causes memcpy to overflow the sixty-four-byte buffer in qla_i2c_access, corrupting adjacent stack variables and potentially overwriting return addresses or other critical control structures.
This vulnerability is classified under CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. From a threat modeling perspective aligned with the MITRE ATT&CK framework, this flaw facilitates privilege escalation when exploited by an attacker possessing CAP_SYS_RAWIO capabilities. The ability to corrupt both heap and stack memory allows for arbitrary code execution or denial of service conditions within the kernel space. The impact is severe as it undermines the isolation boundaries between user-space applications and core kernel operations, potentially leading to full system compromise if combined with other exploitation techniques such as return-oriented programming or data-only attacks targeting specific kernel structures.
To mitigate this vulnerability, developers must enforce strict bounds checking on all input lengths before initiating any memory copy or DMA transfer operations within the qla2x00_write_i2c and qla2x00_read_i2c functions. Specifically, the driver should verify that i2c->length does not exceed sixty-four bytes for writes to ensure it fits within the fixed buffer of struct qla_i2c_access, and similarly validate lengths against the 256-byte DMA pool where appropriate depending on the specific operational constraints. Implementing these checks prevents out-of-bounds accesses and ensures that memory operations remain confined to their allocated regions. System administrators should apply kernel updates provided by distribution vendors that include this patch to close the security gap immediately, as unpatched systems remain vulnerable to exploitation by local users with raw I/O privileges.