HIGH Introduced in 3.2
qla2xxx FruVersion OOB
CVE-2026-89858
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer.
02KernelScan AI Analysis
Risk summary
A local user with access to a QLogic Fibre Channel HBA's BSG device node can supply an unbounded count value in a FRU-version update request, causing the driver to read past a fixed stack buffer. This leaks kernel stack memory to the device and can crash the kernel if the read walks into unmapped memory. Systems without QLogic FC hardware or without local access are not affected.
Vulnerability analysis
The driver handles FRU-version updates by copying a user-supplied request into a small on-stack buffer, then trusting an unvalidated entry count from that request to control how many items it processes. By supplying a count larger than the buffer can hold, an attacker can make the driver read past the buffer into adjacent kernel stack memory and forward that leaked data to the hardware. The correction adds a bounds check that refuses requests whose declared number of entries would exceed the buffer. The flaw can be reached by any local process that can open the QLogic adapter's management device, and it only affects systems with this Fibre Channel hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 3.2 | 6.6.157 | 047f1f7ee6f8 |
| 5.15 | 3.2 | 5.15.221 | a9706d5e754e |
| 5.10 | 3.2 | 5.10.270 | af733bbfcf66 |
| mainline | 3.2 | 7.3-rc1 | de62cf265dbe |
| 6.12 | 3.2 | 6.12.110 | f93e8039e6fd |
| 6.18 | 3.2 | 6.18.51 | 7b22b4cb8822 |
| 6.1 | 3.2 | 6.1.188 | 7e3154c97ec1 |
| 7.2 | 3.2 | 7.2.5 | f2d4f025b67f |
| cip/6.12 | 3.2 | 6.12.111-cip32 | f93e8039e6fd |