Executive brief
The Linux kernel's QLA2XXX SCSI driver contains an information leak vulnerability in its D-Port diagnostics functionality. When performing diagnostics on Fibre Channel devices, uninitialized kernel memory is inadvertently exposed to user-space applications through diagnostic buffers. An attacker with local access to diagnostic interfaces could read sensitive kernel memory contents, potentially exposing cryptographic keys, passwords, or other confidential data.
Technical details
The vulnerability is a classic information disclosure flaw in the QLA2XXX SCSI driver's D-Port diagnostic handler (qla2x00_do_dport_diagnostics function). The root cause is the use of kmalloc_obj() instead of kzalloc_obj() when allocating the qla_dport_diag response buffer. While only some fields are initialized during the diagnostic operation, the entire buffer is copied back to user space via sg_copy_from_buffer(), exposing uninitialized heap memory in the 'options' and 'unused[]' fields. Attack vector requires local access to BSG (Block SCSI Generic) device nodes. The fix, applied in stable kernel tree, is a one-line change: replacing kmalloc_obj() with kzalloc_obj() to zero the buffer at allocation time, matching the pattern already used in the v2 variant of the function.
Affected products
- Linux Linux kernel Multiple versions (see git history; patched in stable tree)
Timeline
- 2026-09-16: disclosed: CVE-2026-89859 published
- 2026-09-11: patched: Fix merged to stable tree
- 2026-07-23: other: Original upstream commit