CVE-2026-89858: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound image count in qla2x00updatefruversions()
qla2x00updatefruversions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMAPOOLSIZE]) and then iterates list->count times over the qlaimageversion array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMAPOOLSIZE - sizeof(list->count)) / sizeof(struct qlaimageversion) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00writesfp().
Reject requests whose declared count does not fit in the buffer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject/avoid processing BSG requests where the declared image count does not fit within the allocated DMA stack buffer (bsg[DMA_POOL_SIZE] used by qla2x00_update_fru_versions()) to prevent out-of-bounds reads and exfiltration of adjacent kernel stack memory.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the qla2xxx SCSI driver are exposed when an attacker can submit a crafted BSG request to qla2x00_update_fru_versions(). The issue is specific to requests handled by that driver path.
What does an attacker need to provide to trigger the out-of-bounds access?
The attacker must supply a BSG request whose declared image list count exceeds the six qla_image_version entries that fit in the driver's 256-byte stack buffer. The unchecked count causes the driver to read beyond that buffer while processing image entries.
What is the impact of a successful exploit?
The driver can read adjacent kernel stack memory and pass that data to the device through qla2x00_write_sfp(). The described issue is an out-of-bounds kernel stack read and potential disclosure to the attached device.
How can I determine whether a system has the fix?
Check whether the installed kernel includes one of the referenced stable commits. The fix rejects requests whose declared image count cannot fit in the fixed buffer.