Executive brief
The Linux kernel's Fibre Channel HBA driver (qla2xxx) contains a buffer over-read vulnerability in firmware update request handling. An attacker with local access can craft a malicious BSG request that reads sensitive kernel stack memory and transmits it to the device, potentially exposing sensitive data like cryptographic keys or other kernel state.
Technical details
The vulnerability is a stack buffer over-read in the qla2x00_update_fru_versions() function in drivers/scsi/qla2xxx/qla_bsg.c. The function copies a user-supplied BSG (Block SG) request into a fixed 256-byte stack buffer without validating that the declared image count fits within that buffer; only 6 qla_image_version entries can fit, but no upper bound is enforced. An attacker can supply a count value larger than 6, causing the pointer to walk off the end of the stack buffer during iteration. This adjacent kernel stack memory is then sent to the device via qla2x00_write_sfp(), leaking sensitive information. The fix adds a struct_size() check to reject requests whose declared count exceeds the buffer capacity before processing.
Affected products
- Linux Linux kernel multiple versions (patch applies across stable and mainline branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89858 published on NVD
- 2026-07-23: patched: Fix committed upstream by Nilesh Javali