CVE-2026-89858 Overview
CVE-2026-89858 is an out-of-bounds read vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel host bus adapters. The function qla2x00_update_fru_versions() copies a user-supplied Block SCSI Generic (BSG) request into a fixed 256-byte stack buffer, then iterates list->count times over an embedded qla_image_version array. Because count is taken directly from user input without validation, a request declaring a count larger than the six entries that actually fit walks the image pointer past the end of the buffer. The driver reads adjacent kernel stack memory and forwards it to the device through qla2x00_write_sfp(), leaking kernel memory contents.
Critical Impact
Local users with access to the qla2xxx BSG interface can read adjacent kernel stack memory and transmit it to attached hardware, exposing sensitive kernel data.
Affected Products
- Linux kernel branches containing the qla2xxx SCSI driver prior to the fix
- Stable kernel trees referenced by commits 047f1f7, 7b22b4c, 7e3154c, a9706d5, af733bb, de62cf2, f2d4f02, and f93e803
- Linux distributions shipping the vulnerable qla2x00_update_fru_versions() code path
Discovery Timeline
- 2026-09-16 - CVE-2026-89858 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89858
Vulnerability Analysis
The flaw resides in qla2x00_update_fru_versions() inside the qla2xxx SCSI driver. The function allocates a 256-byte on-stack buffer sized bsg[DMA_POOL_SIZE] and copies the user-controlled BSG payload into it. The payload contains a count field followed by a variable-length qla_image_version array. The driver then loops list->count times, incrementing a pointer into that stack buffer on each iteration and passing the current entry to qla2x00_write_sfp().
Only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) — six entries — fit inside the buffer. When count exceeds six, the loop reads beyond the allocated stack region into adjacent kernel stack frames. Each out-of-bounds entry is then written to the Fibre Channel adapter through the Small Form-factor Pluggable (SFP) write path, exfiltrating kernel stack contents to the device.
Root Cause
The root cause is missing input validation [CWE-125] on the user-supplied count field. The driver trusts a length value from userspace without comparing it against the fixed capacity of the stack buffer. The upstream fix rejects requests whose declared count does not fit in the buffer before entering the iteration loop.
Attack Vector
Exploitation requires local access to the qla2xxx BSG interface, which is typically restricted to privileged users on systems with QLogic Fibre Channel HBAs. An attacker with that access crafts a BSG request declaring a count larger than six and submits it to the driver. The driver's loop then reads kernel stack data adjacent to the bsg buffer and transmits that data to the attached Fibre Channel device. An attacker with control of the device or with the ability to observe SFP writes can recover leaked kernel memory.
No verified public exploitation code is available. See the referenced Linux Kernel Commit 047f1f7 for the sanctioned bounds check.
Detection Methods for CVE-2026-89858
Indicators of Compromise
- Unexpected ioctl or BSG requests targeting qla2xxx devices from non-administrative processes.
- Kernel logs referencing qla2x00_update_fru_versions invocations followed by anomalous SFP writes.
- Unusual firmware or FRU version update activity on Fibre Channel adapters outside change windows.
Detection Strategies
- Audit SG_IO and BSG ioctl calls against /dev/bsg/* nodes bound to qla2xxx HBAs.
- Monitor loaded kernel module versions against a known-patched baseline for qla2xxx.
- Correlate userland process telemetry with kernel driver activity to identify unauthorized FRU update attempts.
Monitoring Recommendations
- Track access to /dev/bsg/* device nodes and alert on non-root processes issuing writes.
- Ingest dmesg and kmsg telemetry into a central log store and search for qla2xxx warnings.
- Baseline expected Fibre Channel management traffic and flag out-of-band FRU version writes.
How to Mitigate CVE-2026-89858
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 047f1f7, 7b22b4c, 7e3154c, a9706d5, af733bb, de62cf2, f2d4f02, and f93e803.
- Restrict access to qla2xxx BSG device nodes so that only trusted administrators can issue ioctl requests.
- Rebuild and redeploy custom kernels that carry the vulnerable qla2x00_update_fru_versions() code path.
Patch Information
The fix adds a bounds check that rejects BSG requests whose declared image count would exceed the six entries that fit in the 256-byte stack buffer. Patched commits are published across multiple stable branches: Commit 047f1f7, Commit 7b22b4c, Commit 7e3154c, Commit a9706d5, Commit af733bb, Commit de62cf2, Commit f2d4f02, and Commit f93e803. Consult your distribution's advisories for backported package versions.
Workarounds
- Blacklist the qla2xxx module on hosts that do not require QLogic Fibre Channel connectivity.
- Tighten permissions on /dev/bsg/* nodes so that only privileged administrative accounts can open them.
- Constrain user namespaces and capability grants that would allow untrusted processes to reach the BSG interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
