CVE-2026-89865

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE

(256-byte) bounce buffer obtained from dma_pool_alloc(), which does not

zero the allocation. They initialize only a few leading bytes before

handing the buffer to qla2x00_write_sfp().

qla2x00_write_sfp() can override the transfer length with a user-supplied

value:

if (len == 1)

opt |= BIT_0;

if (opt & BIT_0)

len = *sfp;

*sfp is the first byte of the (user-controlled) payload, so len can grow

up to 255. The device then DMA-reads len bytes from the 256-byte pool

buffer. Since only a small prefix was written

(e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU

status register), the hardware reads past the initialized region and

writes up to ~219 bytes of stale DMA-pool heap memory to the device

flash.

Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References