CVE-2026-89852: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89852 Overview

CVE-2026-89852 is a Linux kernel information disclosure vulnerability in the qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The flaw resides in qla2x00_get_firmware_state(), where a stack-allocated mbx_cmd_t mailbox structure is left uninitialized before use. When qla2x00_mailbox_command() takes an early-return path, the driver still copies mailbox register values into the caller's states[] array, exposing raw kernel stack contents through the fw_state and mpi_fw_state sysfs handlers.

Critical Impact
Local users with read access to qla2xxx sysfs attributes can read uninitialized kernel stack memory, potentially disclosing sensitive data such as pointers, credentials, or KASLR-relevant addresses.

Affected Products

Linux kernel scsi/qla2xxx driver (multiple stable branches, per the backport commits referenced by kernel.org)
Systems using QLogic 2xxx-series Fibre Channel host bus adapters
Distributions shipping affected kernel versions until backports land

Discovery Timeline

2026-09-16 - CVE-2026-89852 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89852

Vulnerability Analysis

The qla2xxx driver implements a helper, qla2x00_get_firmware_state(), that queries the adapter firmware and returns state values to the caller. The helper declares an mbx_cmd_t mc on the stack, populates a small subset of fields, and dispatches the request through qla2x00_mailbox_command().

The underlying dispatcher contains several early-exit paths: PCI permanent failure, device failed state, EEH bus in the busy state, an ISP abort already pending, mailbox access timeout, and mailbox purge. Along any of these paths, the function returns without writing the input mailbox registers back into mcp->mb[].

The caller does not check the return value before copying mcp->mb[1..6] and mcp->mb[12] into the user-visible states[] array. Those slots still hold whatever data was on the stack at allocation time. The values are then surfaced through the fw_state and mpi_fw_state sysfs attributes, giving any process that can read those files a window into kernel stack memory. This is a classic uninitialized memory use pattern that leads to information disclosure.

Root Cause

The root cause is a missing zero-initialization of the mbx_cmd_t struct on the stack, combined with an unconditional copy of mailbox output on paths where the dispatcher never wrote those fields. The fix zeros the mailbox struct so failed queries return deterministic zeros instead of stale stack contents.

Attack Vector

Exploitation requires local access to the target system and read permissions on the qla2xxx sysfs attributes (fw_state, mpi_fw_state) exposed for a QLogic FC HBA. An attacker triggers or waits for a condition that causes qla2x00_mailbox_command() to take one of the early-return paths, then reads the sysfs attribute to receive uninitialized stack data. Repeated reads under varying kernel states can be aggregated to reconstruct pointers or other sensitive values useful for further attacks such as KASLR bypass.

No verified public exploit code is available for this issue. See the upstream fixes referenced in the Kernel Git Commit 13d645a and companion backports.

Detection Methods for CVE-2026-89852

Indicators of Compromise

Unexpected or repeated reads of /sys/class/scsi_host/hostX/fw_state or mpi_fw_state by non-administrative processes.
Kernel logs showing qla2xxx mailbox timeouts, EEH events, or ISP abort messages coinciding with sysfs polling.
Non-root user processes enumerating SCSI host attributes on systems equipped with QLogic FC HBAs.

Detection Strategies

Audit process access to qla2xxx sysfs paths using auditd file watches on /sys/class/scsi_host/*/fw_state and mpi_fw_state.
Inventory Linux systems running QLogic FC adapters and cross-reference their running kernel versions against the fixed commits published on kernel.org.
Correlate qla2xxx error events in dmesg with subsequent sysfs reads to identify potential probing behavior.

Monitoring Recommendations

Forward kernel logs and auditd records to a centralized log platform for correlation and retention.
Alert on repeated non-root reads of SCSI host mailbox state attributes.
Track patch state across the Linux fleet and flag hosts that remain on pre-fix kernels running the qla2xxx driver.

How to Mitigate CVE-2026-89852

Immediate Actions Required

Identify all Linux hosts loading the qla2xxx module using lsmod | grep qla2xxx.
Apply the vendor-provided kernel update that includes the upstream fix zeroing the mbx_cmd_t struct in qla2x00_get_firmware_state().
Restrict read access to qla2xxx sysfs attributes to privileged users where operationally acceptable.
Reboot updated systems to load the patched kernel and verify the module version post-boot.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. See the upstream patch and backports: Kernel Git Commit 13d645a, Kernel Git Commit 1f49e86, Kernel Git Commit 2f847f0, Kernel Git Commit 9efaa78, Kernel Git Commit 9f31de4, Kernel Git Commit e6cfb1e, Kernel Git Commit f29695b, and Kernel Git Commit f8fc5cc. Consume the fix through your distribution's kernel package update channel.

Workarounds

Tighten permissions on /sys/class/scsi_host/*/fw_state and mpi_fw_state so only root can read them.
Blacklist the qla2xxx module on systems that do not require QLogic FC connectivity.
Limit local shell access on affected servers to trusted administrators until the patched kernel is deployed.

bash

# Example: restrict read access to qla2xxx firmware state sysfs attributes
for f in /sys/class/scsi_host/host*/fw_state /sys/class/scsi_host/host*/mpi_fw_state; do
    [ -e "$f" ] && chmod 600 "$f"
done

# Optional: prevent the driver from loading if the HBA is not required
echo "blacklist qla2xxx" | sudo tee /etc/modprobe.d/blacklist-qla2xxx.conf
sudo update-initramfs -u