Executive brief
The Linux kernel's qla2xxx SCSI driver contains a vulnerability where uninitialized kernel stack memory can be exposed to userspace through sysfs handlers when firmware state queries fail. When certain error conditions occur during mailbox command processing, the driver copies uninitialized stack values instead of properly initialized data, potentially exposing sensitive kernel memory contents to unprivileged users.
Technical details
The vulnerability exists in the qla2x00_get_firmware_state() function in the qla2xxx SCSI driver, where an mbx_cmd_t structure allocated on the stack remains uninitialized. When qla2x00_mailbox_command() encounters early-return error paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, or purge mbox), it returns without populating the mailbox registers in mcp->mb[]. The calling function unconditionally copies mcp->mb[1..6] and mb[12] into the caller's states array regardless of the return value, exposing uninitialized kernel stack memory. This memory is then accessible to unprivileged users via the fw_state and mpi_fw_state sysfs handlers. The fix initializes the mailbox structure with memset() to ensure failed queries return deterministic zeroed values instead of leaking stack contents.
Affected products
- Linux Linux kernel Multiple versions affected; fix applied to stable branches
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-14: patched: Fix committed to stable kernel branches by Greg Kroah-Hartman