Executive brief
The Linux kernel's qla2xxx SCSI driver handles Block SG (Block SCSI Generic) requests for Marvell QLogic HBAs. Due to improper initialization of stack buffers in five BSG handlers, uninitialized kernel memory containing sensitive data can be disclosed to unprivileged user-space applications through BSG ioctl interface. An attacker with local access could exploit this to read kernel memory and potentially leak cryptographic keys, addresses, or other sensitive data.
Technical details
The vulnerability is an information disclosure (stack memory leak) in five qla2xxx BSG request handlers: qla2x00_update_fru_versions(), qla2x00_read_fru_status(), qla2x00_write_fru_status(), qla2x00_write_i2c(), and qla2x00_read_i2c(). Each handler declares a 256-byte uninitialized on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) and populates it via sg_copy_to_buffer(), which copies only as many bytes as the user-supplied payload. When requests are shorter than the declared structure, remaining stack bytes retain stale kernel data. Functions qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full 256-byte buffer back to user space via sg_copy_from_buffer(), leaking uninitialized stack memory. The fix initializes the buffer to zero at declaration (uint8_t bsg[DMA_POOL_SIZE] = {}) in all five handlers. Attack requires local unprivileged access to the BSG ioctl interface and no authentication beyond kernel permissions.
Affected products
- Linux Linux kernel multiple versions (see git history; patch backported across stable branches 4.4.y through 7.2.y)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-14: patched: Committed to stable kernel trees by Greg Kroah-Hartman
- 2026-07-30: other: Upstream patch authored by Nilesh Javali