CVE-2026-89856 Overview
CVE-2026-89856 is a numeric truncation flaw in the Linux kernel qla2xxx SCSI driver for QLogic Fibre Channel HBAs. The driver stores ha->msix_count as u16 but derives ha->max_req_queues, ha->max_rsp_queues, and ha->max_qpairs as u8. When a device advertises 257 MSI-X vectors, the derived count truncates to zero, and target mode can further underflow the value to 255. The zero-count path then calls kzalloc_objs() with size 0, returning ZERO_SIZE_PTR, which the driver dereferences as a valid queue pointer.
Critical Impact
A malicious or misconfigured hot-plugged Fibre Channel device can corrupt kernel memory or crash the host through a dereference of ZERO_SIZE_PTR.
Affected Products
- Linux kernel qla2xxx SCSI driver (upstream, prior to the fix commits listed in the NVD references)
- Distributions shipping vulnerable stable kernel branches referenced by commits 2efe50b, 33c7725, 7a448f5, 802068b, 9eeddbe, cf623d3, e80adfe, and ebfd35c
- Systems using QLogic Fibre Channel HBAs where hot-plug of untrusted PCIe devices is possible
Discovery Timeline
- 2026-09-16 - CVE-2026-89856 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89856
Vulnerability Analysis
The flaw is a numeric truncation and integer underflow issue [CWE-197, CWE-191] in the qla2xxx driver's queue-count derivation logic. The MSI-X vector count is a 16-bit field, while the driver's derived queue counts are 8-bit fields. Assigning ha->max_req_queues = ha->msix_count - 1 silently discards the upper bits.
A device reporting 257 MSI-X vectors produces msix_count - 1 == 256, which truncates to 0 in u8. A count of 1 also results in 0. In target mode, a subsequent ha->max_req_queues-- on a zero value underflows to 255, further inflating queue-related allocations and indexing.
When the derived queue count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0). This returns ZERO_SIZE_PTR, a non-NULL sentinel. The allocation check succeeds, and the driver executes ha->req_q_map[0] = req, dereferencing ZERO_SIZE_PTR. The result is kernel memory corruption or a panic.
Root Cause
The root cause is missing bounds enforcement between the u16 MSI-X vector count and the u8 queue-count fields it feeds. The driver trusts device-advertised MSI-X counts and performs no clamping before assignment. The target-mode decrement path additionally lacks a zero-guard, permitting underflow.
Attack Vector
The attack requires local physical or logical PCIe access to attach a Fibre Channel HBA that advertises a crafted MSI-X vector count. Threat models include malicious hot-plugged PCIe devices, compromised firmware on legitimate HBAs, or virtualization scenarios exposing untrusted PCI configuration to a host driver. Successful exploitation triggers kernel-space memory corruption without user interaction.
The fix introduces qla_calc_queue_count(), which clamps the derived value into the range [1, QLA_MAX_QUEUES - 1]. It is applied at qla25xx_iospace_config(), qla83xx_iospace_config(), and qla24xx_enable_msix(). The target-mode decrement is guarded to prevent re-introducing zero. See the kernel commits linked in the NVD references for the exact patch content.
Detection Methods for CVE-2026-89856
Indicators of Compromise
- Kernel oops or general protection fault traces referencing qla2x00_alloc_queues, qla2xxx_probe_one, or dereferences at low addresses consistent with ZERO_SIZE_PTR (address 0x10).
- Unexpected qla2xxx driver crashes immediately following PCIe hot-plug events or system boot with a Fibre Channel HBA attached.
- Kernel logs showing ha->max_req_queues values of 0 or 255 on affected systems.
Detection Strategies
- Inventory running kernel versions against the fix commits listed in the NVD advisory and flag hosts running vulnerable qla2xxx builds.
- Monitor dmesg and journalctl -k for qla2xxx initialization anomalies and MSI-X vector counts outside expected ranges for the installed HBA model.
- Correlate PCIe hot-plug events with subsequent kernel faults to identify potential exploitation attempts against Fibre Channel controllers.
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) to capture faulting context in qla2xxx code paths for post-incident analysis.
- Alert on new PCIe device enumeration events on production storage hosts, especially devices identifying as QLogic HBAs outside change windows.
- Track kernel package versions across the fleet and generate alerts when hosts drift from patched baselines.
How to Mitigate CVE-2026-89856
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 2efe50b, 33c7725, 7a448f5, 802068b, 9eeddbe, cf623d3, e80adfe, and ebfd35c or install vendor kernel updates that include them.
- Restrict physical and logical access to PCIe slots and Fibre Channel fabric ports on affected hosts until patches are deployed.
- Audit virtualization and PCI passthrough configurations to ensure untrusted guests cannot present arbitrary MSI-X vector counts to the host qla2xxx driver.
Patch Information
The fix adds qla_calc_queue_count() to clamp derived queue counts into [1, QLA_MAX_QUEUES - 1] and guards the target-mode decrement. It is applied at the three MSI-X derivation sites in qla25xx_iospace_config(), qla83xx_iospace_config(), and qla24xx_enable_msix(). Refer to the Kernel Git Commit 802068b and the other stable-tree backport commits listed in the NVD references for branch-specific patches.
Workarounds
- Blacklist the qla2xxx module on systems that do not require Fibre Channel connectivity using modprobe.d configuration until the kernel is patched.
- Disable PCIe hot-plug on servers that do not require it, either in firmware or via kernel command-line parameters, to reduce the attack surface.
- Where feasible, disable target mode in qla2xxx to eliminate the underflow path introduced by the post-decrement on zero.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
