CVE-2026-89859: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89859 Overview

CVE-2026-89859 is an information disclosure vulnerability in the Linux kernel's qla2xxx SCSI driver for QLogic Fibre Channel adapters. The flaw resides in qla2x00_do_dport_diagnostics(), which allocates a diagnostics response buffer using the non-zeroing kmalloc_obj() helper. The driver later copies the full sizeof(*dd) structure back to user space through sg_copy_from_buffer(). Because the options and unused[] fields are never initialized, the driver leaks kernel heap contents to unprivileged callers issuing dport diagnostics ioctls.

Critical Impact
Local users with access to the qla2xxx SCSI transport can retrieve uninitialized kernel heap memory, potentially exposing sensitive kernel data useful for privilege escalation or KASLR bypass.

Affected Products

Linux kernel builds shipping the qla2xxx SCSI driver prior to the fix commits
Distributions relying on stable kernel trees before backport of a152edab3854 / 9fc03be98276
Systems using QLogic Fibre Channel HBAs that expose dport diagnostics via SCSI transport

Discovery Timeline

2026-09-16 - CVE-2026-89859 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89859

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure [CWE-908] in the QLogic Fibre Channel driver's dport diagnostics path. When a user issues a dport diagnostics request, qla2x00_do_dport_diagnostics() allocates a qla_dport_diag structure on the kernel heap. The allocator used, kmalloc_obj(), does not zero the returned memory. The inbound sg_copy_to_buffer() populates only the bytes supplied by the user request payload, and the downstream qla26xx_dport_diagnostics() routine explicitly zeroes only the dd->buf member.

After the diagnostics command completes, the driver copies the entire structure back to user space via sg_copy_from_buffer(). The options field and the unused[] padding array retain whatever residual data occupied that heap slab, which may include pointers, credentials, cryptographic material, or other kernel objects previously freed to the same slab cache.

Root Cause

The root cause is a mismatch between allocation semantics and the output contract of the ioctl handler. The sibling function qla2x00_do_dport_diagnostics_v2() correctly uses kzalloc_obj(), but the v1 handler was never updated. Copying sizeof(*dd) back to user space when only a subset of the structure is initialized violates the invariant that kernel-to-user copies must contain only sanitized data.

Attack Vector

Exploitation requires local access to the affected system with permission to issue SCSI transport ioctls against a QLogic Fibre Channel HBA. An attacker repeatedly invokes the dport diagnostics interface, harvesting the uninitialized options and unused[] bytes on each call. By spraying the kernel slab allocator before each request, an attacker can influence what residual data is captured, converting the primitive into a targeted heap read useful for defeating KASLR or leaking sensitive structures.

Refer to the upstream fix commits for exact code paths: Kernel.org Commit Details and Kernel.org Commit Notes.

Detection Methods for CVE-2026-89859

Indicators of Compromise

Unusual frequency of dport diagnostics ioctls originating from non-administrative processes
Unexpected user-space processes opening SCSI generic devices tied to QLogic Fibre Channel HBAs
Kernel audit records showing repeated SG_IO calls targeting qla2xxx transports

Detection Strategies

Enable Linux audit rules on SCSI generic device nodes and correlate on high-volume ioctl activity per UID
Compare running kernel build identifiers against distribution advisories referencing commits 9fc03be98276 and a152edab3854
Instrument eBPF probes on qla2x00_do_dport_diagnostics to record caller PID, UID, and invocation counts

Monitoring Recommendations

Baseline legitimate diagnostic tooling that touches QLogic HBAs and alert on deviations
Forward kernel and audit logs into a centralized data lake for retrospective analysis after patching
Track slab allocator telemetry for anomalous churn in the caches that back qla_dport_diag allocations

How to Mitigate CVE-2026-89859

Immediate Actions Required

Inventory hosts running the qla2xxx driver and identify systems exposing SCSI ioctls to non-root users
Apply vendor kernel updates that include the upstream fix switching to kzalloc_obj()
Restrict access to /dev/sg* and related SCSI transport nodes to trusted administrators only

Patch Information

The upstream fix replaces kmalloc_obj() with kzalloc_obj() in qla2x00_do_dport_diagnostics(), matching the behavior of qla2x00_do_dport_diagnostics_v2(). This ensures that the options and unused[] fields are zero-initialized before any partial user-controlled data is written, eliminating the leak. Fix commits are available at Kernel.org Commit Details and Kernel.org Commit Notes. Consult your distribution's security tracker for backported package versions.

Workarounds

Unload the qla2xxx module on systems that do not require QLogic Fibre Channel connectivity using modprobe -r qla2xxx
Tighten permissions on SCSI generic device nodes via udev rules so only privileged administrative accounts can issue ioctls
Constrain container and VM workloads so they cannot access host SCSI transports directly

bash

# Example udev rule to restrict SCSI generic access to root only
# /etc/udev/rules.d/60-scsi-generic-restrict.rules
KERNEL=="sg[0-9]*", MODE="0600", OWNER="root", GROUP="root"