CVE-2026-89859: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
qla2x00dodportdiagnostics() allocates the qladportdiag response buffer with kmallocobj() (non-zeroing) and, on success, copies the full sizeof(dd) back to user space via sgcopyfrombuffer(). The inbound sgcopytobuffer() only fills as many bytes as the user request payload provides, and qla26xxdportdiagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space.
Allocate with kzallocobj(), matching qla2x00dodportdiagnosticsv2().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In qla2x00_do_dport_diagnostics(), zero the allocated qla_dport_diag response buffer before sg_copy_to_buffer()/copying the full response back to user space. Specifically, replace non-zeroing allocation with kzalloc_obj() (and ensure the whole response buffer is initialized), rather than allocating with kmalloc_obj() (non-zeroing) and leaving options/unused fields uninitialized.
Linux kernel (qla2xxx dport diagnostics) qla_dport_diag response buffer initialization = Zero the qla_dport_diag buffer before copying it to user space (allocate with kzalloc_obj() / ensure zeroing, not kmalloc_obj() non-zeroing)
Event History
Frequently Asked Questions
Who can trigger the information leak?
A user able to submit the affected dport diagnostics request to the qla2xxx driver can receive uninitialized kernel heap contents in the response. The leak occurs when the supplied request payload does not initialize all fields later copied back to user space.
What data may be disclosed?
The uninitialized options and unused[] fields in the qla_dport_diag response structure may expose kernel heap contents. The description does not identify the exact contents or sensitivity of the leaked memory.
What is the remediation?
Use a kernel version containing the change that allocates the diagnostics response structure with kzalloc_obj() rather than non-zeroing kmalloc_obj(). This ensures fields not populated by the request are zeroed before the full structure is returned to user space.