CVE-2026-89864 Overview
CVE-2026-89864 is a kernel-mode buffer overflow in the Linux qla2xxx SCSI driver. The flaw resides in the I2C block SCSI generic (BSG) handlers qla2x00_write_i2c() and qla2x00_read_i2c(). Both functions accept a user-supplied 16-bit length field from struct qla_i2c_access and pass it to memcpy() and DMA operations without validating it against the fixed 64-byte buffer or the 256-byte staging buffers.
A local caller holding CAP_SYS_RAWIO can supply a length up to 65535 bytes, corrupting the kernel stack and the DMA-pool heap. The upstream fix rejects any request whose length exceeds the buffer before any copy or DMA transfer.
Critical Impact
A CAP_SYS_RAWIO-privileged local process can corrupt kernel stack and heap memory through the qla2xxx I2C BSG interface, enabling denial of service or privilege escalation.
Affected Products
- Linux kernel versions containing the qla2xxx SCSI driver with unpatched I2C BSG handlers
- Systems using QLogic Fibre Channel host bus adapters supported by qla2xxx
- Distributions shipping the affected kernel prior to the fix commits referenced in kernel.org
Discovery Timeline
- 2026-09-16 - CVE-2026-89864 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89864
Vulnerability Analysis
The vulnerability is a classic missing bounds check on attacker-controlled length values passed to memcpy() and DMA routines inside the Linux kernel. The structure struct qla_i2c_access packs a 16-bit length field alongside a fixed uint8_t buffer[0x40] (64 bytes). The i2c structure is overlaid on a 256-byte on-stack buffer, while sfp points to a 256-byte DMA-pool allocation.
Because length is uint16_t, callers may specify values up to 65535 bytes. Neither handler validates this value before invoking copy or DMA operations, producing both out-of-bounds reads and out-of-bounds writes across two distinct memory regions.
Root Cause
The root cause is improper input validation [CWE-20] combined with a heap and stack buffer overflow [CWE-121, CWE-122]. In the write path, memcpy(sfp, i2c->buffer, i2c->length) over-reads the 256-byte on-stack region and over-writes the 256-byte sfp heap buffer. qla2x00_write_sfp() then DMAs i2c->length bytes out of that undersized buffer.
In the read path, qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp buffer, and the subsequent memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte buffer field embedded in the on-stack qla_i2c_access structure.
Attack Vector
Exploitation requires local access and the CAP_SYS_RAWIO capability, which is typically restricted to root or privileged service accounts. An attacker issues a crafted BSG ioctl to the qla2xxx driver with a length value exceeding 64 bytes. The overflow corrupts adjacent stack frames or DMA-pool heap chunks, potentially overwriting return addresses, function pointers, or kernel object metadata.
The vulnerability does not appear to be remotely exploitable and requires physical or shell-level access to a system with a QLogic Fibre Channel HBA present.
No verified public exploit code is available. See the upstream kernel fix commit for full patch context.
Detection Methods for CVE-2026-89864
Indicators of Compromise
- Unexpected kernel panics, stack traces, or KASAN reports referencing qla2x00_write_i2c or qla2x00_read_i2c
- Unusual BSG ioctl activity from non-administrative processes against /dev/bsg/ nodes tied to qla2xxx HBAs
- Kernel oops messages citing slab corruption in DMA pools associated with the qla2xxx driver
Detection Strategies
- Enable KASAN or SLUB_DEBUG on test kernels to surface out-of-bounds writes originating from qla2xxx code paths
- Audit process invocations of the SCSI BSG interface and correlate against processes holding CAP_SYS_RAWIO
- Monitor kernel ring buffer output (dmesg) for repeated qla2xxx warnings following I2C access attempts
Monitoring Recommendations
- Track loading of the qla2xxx module on hosts that do not require QLogic Fibre Channel connectivity and alert on unexpected load events
- Log all users and processes granted CAP_SYS_RAWIO and review privileged tool usage regularly
- Forward kernel logs to a centralized logging platform to identify repeated driver faults across the fleet
How to Mitigate CVE-2026-89864
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org stable tree fix commits
- Restrict CAP_SYS_RAWIO to only the minimum set of administrative users and service accounts required
- Blacklist the qla2xxx module on systems that do not use QLogic Fibre Channel adapters
Patch Information
The fix rejects requests whose length exceeds the destination buffer before any memcpy() or DMA transfer in both qla2x00_write_i2c() and qla2x00_read_i2c(). Multiple stable-tree backports are available; see the primary fix commit and the additional backport commits published at kernel.org. Distribution vendors should ship updated kernel packages incorporating these commits.
Workarounds
- Unload the qla2xxx module (modprobe -r qla2xxx) on systems that do not require Fibre Channel storage
- Remove CAP_SYS_RAWIO from any container or service that does not strictly require raw SCSI access
- Restrict access to /dev/bsg/* device nodes using strict filesystem permissions and mandatory access control policies
# Prevent qla2xxx module from loading on systems that do not need it
echo 'blacklist qla2xxx' | sudo tee /etc/modprobe.d/blacklist-qla2xxx.conf
sudo update-initramfs -u
# Verify current CAP_SYS_RAWIO grants on running processes
sudo getpcaps $(pgrep -d, .) 2>/dev/null | grep -i sys_rawio
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
