CVE-2026-89858

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

qla2x00_update_fru_versions() copies the user-supplied BSG request into

a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates

list->count times over the qla_image_version array embedded in that

buffer, advancing the image pointer each iteration. count is taken

directly from user input with no upper bound, while only (DMA_POOL_SIZE

- sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries

actually fit. A larger count walks the image pointer off the end of the

stack buffer, reading adjacent kernel stack memory and sending it to the

device via qla2x00_write_sfp().

Reject requests whose declared count does not fit in the buffer.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References