CVE-2026-89859: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
qla2x00dodportdiagnostics() allocates the qladportdiag response buffer with kmallocobj() (non-zeroing) and, on success, copies the full sizeof(dd) back to user space via sgcopyfrombuffer(). The inbound sgcopytobuffer() only fills as many bytes as the user request payload provides, and qla26xxdportdiagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space.
Allocate with kzallocobj(), matching qla2x00dodportdiagnosticsv2().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change qla2x00_do_dport_diagnostics() to allocate the qla_dport_diag response buffer with kzalloc_obj() instead of kmalloc_obj(), matching qla2x00_do_dport_diagnostics_v2(), so the entire buffer is zero-initialized before sg_copy_from_buffer() copies sizeof(*dd) to user space.
Event History
Frequently Asked Questions
Who can trigger the information leak?
A user able to submit the affected dport diagnostics request to the qla2xxx driver can receive uninitialized kernel heap contents in the response. The leak occurs when the supplied request payload does not initialize all fields later copied back to user space.
What data may be disclosed?
The uninitialized options and unused[] fields in the qla_dport_diag response structure may expose kernel heap contents. The description does not identify the exact contents or sensitivity of the leaked memory.
What is the remediation?
Use a kernel version containing the change that allocates the diagnostics response structure with kzalloc_obj() rather than non-zeroing kmalloc_obj(). This ensures fields not populated by the request are zeroed before the full structure is returned to user space.