CVE-2026-89852: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate()
The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00getfirmwarestate() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value.
On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fwstate and mpifwstate sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the qla2x00_get_firmware_state() / qla2x00_mailbox_command() logic (scsi: qla2xxx) so the mailbox struct (mcp->mb / mailbox contents, including mb[1..6] and mb[12]) is zeroed so early-return paths do not leave uninitialized stack values that could be exposed via fw_state and mpi_fw_state sysfs handlers.
Linux kernel (scsi: qla2xxx) Zero mailbox struct in qla2x00_get_firmware_state() / qla2x00_mailbox_command() before early returns = states[] array regardless of the return value
Event History
Frequently Asked Questions
Which systems are exposed to the information leak?
Exposure is limited to Linux kernel systems using the qla2xxx driver where the fw_state or mpi_fw_state sysfs handlers can invoke qla2x00_get_firmware_state(). The leak occurs when the underlying mailbox command fails before writing mailbox-register results back to the stack-allocated structure.
What failure conditions can cause stale stack data to be returned?
The affected mailbox-command paths include PCI permanent failure, device failure, EEH busy status, an ISP abort pending condition, mailbox access timeout, and mailbox purge. Despite these failures, the firmware-state function copies mailbox fields into its output array.
What does the fix change when a firmware-state query fails?
The mailbox structure is zeroed before use. A failed query therefore returns deterministic zeroed state values rather than uninitialized kernel stack contents.