CVE-2026-89852

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

The mbx_cmd_t is allocated on the stack but left uninitialized.

qla2x00_mailbox_command() has several early-return paths (PCI permanent

failure, device failed, EEH busy, ISP abort pending, mailbox access

timeout, purge mbox) that return without writing the input mailbox

registers back into mcp->mb[]. qla2x00_get_firmware_state() then

unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's

states[] array regardless of the return value.

On such a failure the copied values are uninitialized kernel stack

memory, which is then exposed to userspace via the fw_state and

mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query

yields deterministic zeroed state instead of leaking stack contents.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References