CVE-2026-89843: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer (uint8t bsg[DMAPOOLSIZE]) and fill it via sgcopytobuffer(), which only copies as many bytes as the user-supplied request payload. When the request is shorter than the structure, the remainder of the buffer is left holding stale stack data.
qla2x00readfrustatus() and qla2x00readi2c() then copy the full structure back to the reply payload with sgcopyfrombuffer(), leaking the uninitialized stack bytes to user space. The write/update paths do not copy the buffer back, but can feed uninitialized fields to the device.
Zero the stack buffer at declaration in all five handlers, mirroring the heap kzalloc() approach, so short requests can no longer expose stale memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the information leak?
Systems using the Linux kernel qla2xxx SCSI driver are exposed through its BSG handlers. The leak reaches user space when a short request is supplied to the affected read FRU status or read I2C handlers.
What does an attacker need to do to trigger the leak?
An attacker needs to submit a request payload shorter than the handler's expected structure. The handler then returns the full structure, including bytes in the stack buffer that were not populated by the request.
Are all affected handler paths information leaks?
No. The read paths qla2x00_read_fru_status() and qla2x00_read_i2c() copy the full buffer back to user space and can leak stale stack data. The write or update paths do not copy the buffer back, but may pass uninitialized fields to the device.
What is the remediation?
Apply a kernel update containing the fix that zero-initializes the 256-byte BSG stack buffer in all five handlers. This ensures bytes not supplied in a short request are initialized before use or return to user space.