Skip to content
Heist/ feed
Unrated

scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE (256-byte) bounce buffer obtained from dma_pool_alloc(), which does not zero the allocation. They initialize only a few leading bytes before handing the buffer to qla2x00_write_sfp(). qla2x00_write_sfp() can override the transfer length with a user-supplied value: if (len == 1) opt |= BIT_0; if (opt & BIT_0) len = *sfp; *sfp is the first byte of the (user-controlled) payload, so len can grow up to 255. The device then DMA-reads len bytes from the 256-byte pool buffer. Since only a small prefix was written (e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU status register), the hardware reads past the initialized region and writes up to ~219 bytes of stale DMA-pool heap memory to the device flash. Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers so any bytes beyond the initialized data are zero rather than stale heap contents.

Announced Group revision 1
Original source ↗

CVE-2026-89865

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-89865

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "a476377a66897549dd49bee319f4df66623417b7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "09703bc7c0be3a7a155b0ff5f21f6765ba3f519c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "97c45c75f5cdec96b1a4fba8b1d55d0dd01af1e8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "84bde5ce4038d9ad811e5c994305bbfcbd7a9f79",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "581590f560b74399151b3cbc88574424c2f3d2dc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "b157256c28086c434afd70cc78bf9b4d8caf1276",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "a5501c42256235523c4dddf799f032dfbf4f4c77",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "697a4bc69159c3396035b0506ffa55c4b2d0b1f4",
        "lessThan": "b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_bsg.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.2"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.2",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.51",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.5",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_bsg.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-89865

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#36315 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-89865 · Revision 1Source updated