UBUNTU-CVE-2026-89859: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics() allocates the qladportdiag response buffer with kmallocobj() (non-zeroing) and, on success, copies the full sizeof(dd) back to user space via sgcopyfrombuffer(). The inbound sgcopytobuffer() only fills as many bytes as the user request payload provides, and qla26xxdportdiagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space. Allocate with kzallocobj(), matching qla2x00dodportdiagnosticsv2().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change qla2x00_do_dport_diagnostics() to allocate the qla_dport_diag response buffer with kzalloc_obj() instead of kmalloc_obj(), matching qla2x00_do_dport_diagnostics_v2(), so unused fields are zero-initialized before sg_copy_from_buffer() copies the full structure to user space.
Event History
Frequently Asked Questions
Who is exposed to this information leak?
Systems running one of the listed Ubuntu kernel packages may be exposed if they use the qla2xxx SCSI driver and allow a user to invoke the affected dport diagnostics path. The leak is returned to user space, so an attacker needs local access to issue the relevant diagnostic request.
What does an attacker need to do to trigger the issue?
The attacker must provide a dport diagnostics request whose payload does not populate the entire response structure. The driver then copies the full structure back to user space, including uninitialized options and unused fields.
What is the practical impact?
The issue can disclose uninitialized Linux kernel heap contents to user space. The provided data describes an information leak; it does not state that code execution, privilege escalation, or remote exploitation is possible.
Is there a mitigation if an updated kernel cannot be installed immediately?
No specific workaround is provided. Reducing access to the affected qla2xxx dport diagnostics functionality and limiting local access can reduce exposure until the kernel package is updated.