CVE-2026-89843: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89843 Overview

CVE-2026-89843 is an information disclosure vulnerability in the Linux kernel's qla2xxx SCSI driver. Several block SCSI generic (bsg) handlers stage request and reply data in an uninitialized 256-byte on-stack buffer declared as uint8_t bsg[DMA_POOL_SIZE]. The driver populates the buffer with sg_copy_to_buffer(), which only writes as many bytes as the user-supplied request payload provides. When the request is shorter than the target structure, stale stack contents remain in the trailing bytes. The functions qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full buffer back to user space via sg_copy_from_buffer(), leaking kernel stack memory.

Critical Impact
Local users with access to the SCSI bsg interface for a qla2xxx Fibre Channel adapter can read uninitialized kernel stack memory, potentially exposing sensitive data useful for further exploitation.

Affected Products

Linux kernel scsi: qla2xxx driver (QLogic Fibre Channel HBA driver)
Multiple stable kernel branches — see the eight upstream commits referenced in the NVD entry
Systems exposing SCSI bsg interfaces for QLogic Fibre Channel adapters

Discovery Timeline

2026-09-16 - CVE-2026-89843 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89843

Vulnerability Analysis

The flaw is a classic uninitialized-memory information disclosure [CWE-908] in the SCSI Fibre Channel transport layer. Five bsg handlers in drivers/scsi/qla2xxx/ declare a 256-byte stack buffer sized to DMA_POOL_SIZE without zeroing it. The buffer receives a user-provided request through sg_copy_to_buffer(), which copies only the length of the caller-supplied scatter-gather payload. Any portion of the 256-byte buffer beyond the copied length retains whatever data previously occupied that stack frame, including return addresses, pointers, or sensitive kernel state.

Two of the five handlers, qla2x00_read_fru_status() and qla2x00_read_i2c(), subsequently invoke sg_copy_from_buffer() to return the complete buffer contents to user space. A caller who deliberately submits a short request receives the uninitialized trailing bytes back in the reply payload. The remaining write/update handlers do not echo the buffer back to user space but can forward uninitialized values to the Fibre Channel device, producing undefined firmware behavior.

Root Cause

The root cause is missing initialization of a stack-allocated buffer prior to a partial write. The heap-based paths already use kzalloc() to zero their allocations, but the stack paths omit an equivalent step. The fix zero-initializes the bsg[DMA_POOL_SIZE] buffer at declaration in all five affected handlers, mirroring the heap allocator's behavior.

Attack Vector

Exploitation requires local access to issue SCSI bsg ioctl commands against a qla2xxx-managed device. An attacker with the required privileges crafts a bsg request payload shorter than the expected vendor command structure, then reads the reply buffer to recover residual kernel stack bytes. Repeated invocations can be used to sample stack contents and defeat kernel address space layout randomization (KASLR) or extract secrets staged on the stack by prior kernel operations. The vulnerability does not permit direct code execution but is useful as a primitive within a broader exploitation chain.

See the upstream fix commits linked in the NVD references for the exact source changes.

Detection Methods for CVE-2026-89843

Indicators of Compromise

No file-based or network indicators are associated with this vulnerability, since exploitation occurs entirely through legitimate SCSI bsg ioctl calls.
Unusual patterns of short-length bsg requests targeting qla2xxx devices, particularly against FRU status and I2C read commands, may indicate probing.

Detection Strategies

Audit kernel package versions against distribution advisories that reference the upstream commits 1c820d09, 26bc6a2c, 4fe57906, 5ab32dff, 708c0ec1, 7881faf8, 947c6bfc, and b93d3bb3.
Enable Linux Audit rules for ioctl syscalls issued against /dev/bsg/* nodes owned by qla2xxx HBAs to identify unexpected user-space callers.
Correlate access to bsg devices with process identity to spot non-administrative processes interacting with Fibre Channel management interfaces.

Monitoring Recommendations

Track access to SCSI generic devices under /dev/bsg/ and alert when non-root or unexpected service accounts open these nodes.
Baseline the set of processes that legitimately submit bsg vendor commands in the environment, and investigate deviations.
Ship kernel and audit telemetry to a centralized analytics platform for retrospective hunting once patches are applied.

How to Mitigate CVE-2026-89843

Immediate Actions Required

Inventory hosts using QLogic Fibre Channel HBAs with the qla2xxx driver loaded, for example by checking lsmod | grep qla2xxx.
Apply vendor-supplied kernel updates that incorporate the upstream qla2xxx zero-initialization fix as soon as they are available for the distribution in use.
Restrict access to /dev/bsg/* device nodes to trusted administrative accounts pending patch deployment.

Patch Information

The fix zero-initializes the on-stack bsg[DMA_POOL_SIZE] buffer at declaration in all five affected qla2xxx handlers so that trailing bytes cannot leak stale stack data. The change has been merged across multiple stable branches. Refer to the upstream commits: 1c820d09, 26bc6a2c, 4fe57906, 5ab32dff, 708c0ec1, 7881faf8, 947c6bfc, and b93d3bb3.

Workarounds

Tighten permissions on /dev/bsg/* nodes so that only privileged administrators can issue vendor bsg commands to qla2xxx HBAs.
Where Fibre Channel management via bsg is not required, unload the qla2xxx module on systems that do not have QLogic HBAs, or blacklist it via /etc/modprobe.d/.
Apply mandatory access control policies (SELinux or AppArmor) to constrain which processes can open SCSI generic device nodes.

bash

# Verify installed kernel version and qla2xxx module presence
uname -r
lsmod | grep qla2xxx

# Restrict access to SCSI bsg device nodes
ls -l /dev/bsg/
chmod 600 /dev/bsg/*