Linux Kernel up to 7.2.4 qla2xxx qla2x00_do_dport_diagnostics information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.2.4. Affected is the function qla2x00_do_dport_diagnostics of the component qla2xxx. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2026-89859. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.2.4 and classified as problematic. Affected by this vulnerability is the function qla2x00_do_dport_diagnostics of the component qla2xxx. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space. Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-89859 since 09/11/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/16/2026). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 7.2.5 or 7.3-rc1 eliminates this vulnerability. Applying the patch 9fc03be982763a131913f84fe73b240ae45bca37/a152edab3854f01dd2daf3eaf8f32cbabdb3834e is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion