CVE-2026-89846: Linux Kernel QLogic Information Disclosure

CVE-2026-89846 Overview

CVE-2026-89846 is an out-of-bounds read vulnerability in the Linux kernel qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in the qla2x00_status_entry() function, where an unbounded rsp_info_len value taken from a target's Fibre Channel Protocol (FCP) response can cause an unsigned integer underflow. The underflow corrupts subsequent bounds checks in qla2x00_handle_sense(), allowing up to SCSI_SENSE_BUFFERSIZE bytes of adjacent response-ring or heap memory to be copied into a command's sense buffer. The result is disclosure of kernel memory to userspace consumers of SCSI sense data.

Critical Impact
A malicious or malfunctioning Fibre Channel target can trigger kernel memory disclosure and induce driver instability on hosts running affected Linux kernels with the qla2xxx driver.

Affected Products

Linux kernel builds including the qla2xxx SCSI driver for QLogic FWI2-capable Fibre Channel HBAs
Systems using QLogic 24xx series adapters (28-byte IOCB sense data area)
Systems using QLogic 29xx series adapters (60-byte IOCB sense data area)

Discovery Timeline

2026-09-16 - CVE-2026-89846 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89846

Vulnerability Analysis

The vulnerability lives in the FWI2 status path of qla2x00_status_entry(). When the driver processes a completion IOCB from an FWI2-capable adapter, it advances the sense_data pointer and shrinks the par_sense_len counter by rsp_info_len. The rsp_info_len field is a 32-bit value read directly from the target-supplied FCP response (sf.rsp_data_len), while par_sense_len reflects the fixed IOCB data area size — 28 bytes for 24xx adapters and 60 bytes for 29xx adapters.

When a target reports an rsp_info_len larger than par_sense_len, the unsigned subtraction par_sense_len -= rsp_info_len underflows to a very large value. The sense_data pointer is simultaneously advanced past the end of the IOCB data area. Downstream, qla2x00_handle_sense() clamps sense_len to par_sense_len before executing memcpy(cp->sense_buffer, sense_data, sense_len). Because the underflowed par_sense_len is now effectively unbounded, the clamp fails and the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from an out-of-bounds pointer.

Root Cause

The root cause is missing input validation on attacker-influenced protocol data. The driver trusts a target-supplied 32-bit length field without bounding it against the fixed on-chip IOCB sense data area. The subsequent unsigned arithmetic converts an oversized value into a wrap-around that defeats later bounds checks. This is an out-of-bounds read stemming from an integer underflow in length accounting.

Attack Vector

Exploitation requires a Fibre Channel target reachable by the host to return a crafted FCP response with an oversized rsp_data_len field. This can be a hostile target in an untrusted SAN fabric, a compromised storage endpoint, or a buggy device firmware. The attacker does not need credentials on the Linux host; the driver processes the malicious response as part of normal SCSI command completion. Successful exploitation leaks contents of the adapter response ring and adjacent kernel heap memory into the sense buffer, which is exposed to userspace SCSI error-handling paths.

The patch clamps rsp_info_len to par_sense_len before the subtraction, ensuring par_sense_len cannot underflow and sense_data stays within the IOCB data area. The fix is applied before the comp_status switch to cover both qla2x00_handle_sense() call sites. See the upstream fix in Kernel Git Commit 125b12861c.

Detection Methods for CVE-2026-89846

Indicators of Compromise

Unexpected SCSI sense data returned to userspace containing binary content inconsistent with valid sense response codes (byte 0 not in 0x70-0x73).
Kernel log entries referencing qla2xxx status handling for commands whose FCP responses report rsp_data_len larger than 28 or 60 bytes.
Unexplained target-reported rsp_info_len values in vendor-specific debug logs sourced from the SAN fabric.

Detection Strategies

Inventory hosts running the qla2xxx driver and cross-reference kernel versions against the fixed commits listed in the NVD references.
Enable driver-level tracing (qla2xxx ql_dbg logs) to capture FCP response length fields during storage transactions in high-trust environments.
Instrument SAN switches to flag targets emitting FCP_RSP payloads with abnormally large FCP_RSP_INFO lengths.

Monitoring Recommendations

Monitor kernel ring buffers (dmesg, journalctl -k) for qla2xxx errors, sense buffer anomalies, and SCSI abort or reset storms following target reconnection events.
Alert on new or unauthorized Fibre Channel targets appearing in zoning tables or nameserver queries.
Track SCSI mid-layer error-handling escalations that correlate with specific target World Wide Names (WWNs).

How to Mitigate CVE-2026-89846

Immediate Actions Required

Apply the upstream Linux kernel patch to all hosts using the qla2xxx driver. Fixed commits are enumerated in the NVD references, including Kernel Git Commit 125b12861c and Kernel Git Commit f6e8977bce.
Rebuild or update distribution kernels to a version that includes the qla2xxxrsp_info_len bound check.
Audit SAN zoning to ensure only trusted, known-good targets are reachable by Linux initiators.

Patch Information

The upstream fix clamps rsp_info_len to par_sense_len before decrementing par_sense_len, preventing the unsigned underflow that drives the out-of-bounds read. Backports are available across multiple stable branches. Consult the eight referenced kernel Git commits, including Kernel Git Commit 6b08c0cb11, Kernel Git Commit be75ab791c, Kernel Git Commit ca6d880d6c, Kernel Git Commit d7f7746ff0, Kernel Git Commit e57ace988b, and Kernel Git Commit ebc41dfc59, to select the appropriate backport for your kernel branch.

Workarounds

Restrict SAN fabric zoning to permit only vetted target WWNs and disable target auto-discovery where feasible.
On non-essential hosts, unload the qla2xxx module (modprobe -r qla2xxx) until patched kernels are deployed.
Segment storage networks to prevent untrusted or third-party targets from communicating with production Linux initiators.

bash

# Verify running kernel and qla2xxx module status
uname -r
modinfo qla2xxx | grep -E '^(version|filename):'

# Temporarily remove the driver on hosts that do not require Fibre Channel storage
sudo modprobe -r qla2xxx

# Blacklist qla2xxx until a patched kernel is installed
echo 'blacklist qla2xxx' | sudo tee /etc/modprobe.d/blacklist-qla2xxx.conf
sudo update-initramfs -u