CVE-2026-89852
UnknownSummary
In the Linux kernel scsi: qla2xxx driver, the mbx_cmd_t struct is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value.
Risk Assessment
On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. This constitutes a kernel memory information leak.
Recommendation
Update the Linux kernel to a version containing the fix that zeroes the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents. Until the fix is deployed, restrict access to the fw_state and mpi_fw_state sysfs attributes.
Other vulnerabilities in Linux kernel (qla2xxx)
See all- CVE-2026-89856High
In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.
- CVE-2026-89855Unknown
In the Linux kernel scsi: qla2xxx driver, the sysfs reset operation "update cache versions without reset" (0x20261) calls get_flash_version(), which reads hardware flash registers, without holding ha->optrom_mutex. The VPD update path serializes the same call under optrom_mutex, so the reset path can interleave its flash register accesses with a concurrent VPD or optrom flash operation and corrupt the reads.
- CVE-2026-89854High
In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.
- CVE-2026-89853Unknown
In the Linux kernel scsi: qla2xxx driver, qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free.
- CVE-2026-89851Unknown
In the Linux kernel scsi: qla2xxx driver, qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value (0 on success, negative errno on failure) was assigned to the unsigned long enable flag, inverting the intended logic: a valid number was treated as "disable" while a parse failure enabled FCE.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.