CVE-2026-89865: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89865 Overview

CVE-2026-89865 is a Linux kernel vulnerability in the qla2xxx SCSI driver affecting the FRU (Field Replaceable Unit) and I2C block SCSI generic (bsg) handlers. The handlers stage transfers in a 256-byte bounce buffer allocated via dma_pool_alloc(), which does not zero the allocation. A user-controlled length field in qla2x00_write_sfp() can expand the DMA read up to 255 bytes, causing the QLogic Fibre Channel HBA to DMA stale kernel heap contents from the DMA pool into device flash. This exposes uninitialized memory contents to persistent device storage. The fix replaces dma_pool_alloc() with dma_pool_zalloc() across all five FRU/I2C handlers.

Critical Impact
Local privileged users invoking FRU/I2C bsg requests against a QLogic Fibre Channel HBA can leak up to ~219 bytes of stale DMA-pool heap memory into device flash on every call.

Affected Products

Linux kernel qla2xxx SCSI driver (QLogic Fibre Channel HBA driver)
FRU bsg handlers using qla2x00_write_sfp()
I2C bsg handlers using the shared DMA pool bounce buffer

Discovery Timeline

2026-09-16 - CVE-2026-89865 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89865

Vulnerability Analysis

The qla2xxx driver exposes FRU and I2C management operations through the SCSI bsg interface. Each handler obtains a DMA_POOL_SIZE (256-byte) bounce buffer via dma_pool_alloc(). This allocation returns memory without zeroing, so the buffer retains prior heap contents from previous DMA pool uses.

Handlers initialize only a small prefix of the buffer before submitting it to qla2x00_write_sfp(). For example, a FRU version write populates MAX_FRU_SIZE (36 bytes), and a FRU status register write initializes only a single byte. The remaining ~219 bytes retain stale kernel data.

The issue is classified as an uninitialized memory use pattern leading to information disclosure (CWE-908) with a persistent sink: the target device's flash storage.

Root Cause

The root cause is the use of dma_pool_alloc() instead of dma_pool_zalloc() combined with a partially initialized buffer being handed to hardware. Inside qla2x00_write_sfp(), the transfer length can be overridden by user-supplied payload:

When the opt argument has BIT_0 set (or when len == 1, which forces the bit), the function replaces len with *sfp, the first byte of the user-controlled payload. Because *sfp is an unsigned byte, len grows up to 255. The device then DMA-reads len bytes from the 256-byte pool buffer, reading past the caller-initialized prefix.

Attack Vector

A local user with permission to issue FRU/I2C bsg ioctls to a qla2xxx-managed Fibre Channel HBA can trigger the flaw. By crafting a payload whose first byte is large (up to 0xFF) and setting the length-override option, the caller causes the HBA to DMA-read the full 256-byte pool buffer. The hardware then writes those bytes, including up to ~219 bytes of stale DMA-pool heap memory, to the SFP or FRU flash region of the device. This produces a persistent information disclosure on the device and may corrupt firmware/inventory data required by administrators and downstream tooling.

See the upstream fix in Kernel Commit 09703bc7c0be and the related stable-branch backports for technical details.

Detection Methods for CVE-2026-89865

Indicators of Compromise

Unexpected BSG_IOCTL or SG_IO invocations from non-administrative processes targeting qla2xxx HBAs.
FRU or SFP flash regions containing non-zero, non-structured byte sequences beyond the documented field lengths.
Kernel logs from the qla2xxx driver showing repeated FRU/I2C write operations from user space.

Detection Strategies

Audit ioctl syscalls issued against /dev/bsg/* nodes bound to qla2xxx devices and alert on unusual callers.
Compare current FRU/SFP contents against known-good baselines to identify overwritten trailing bytes.
Track kernel version and qla2xxx module version across Fibre Channel hosts to identify unpatched systems.

Monitoring Recommendations

Ingest Linux auditd EXECVE and SYSCALL records for ioctl calls into a centralized SIEM for correlation.
Monitor privileged process activity on storage and virtualization hosts that own QLogic Fibre Channel HBAs.
Alert on new or unsigned kernel modules loading qla2xxx on production storage fabrics.

How to Mitigate CVE-2026-89865

Immediate Actions Required

Inventory all Linux hosts running the qla2xxx driver against QLogic Fibre Channel HBAs.
Apply the upstream fix that switches the five FRU/I2C handlers to dma_pool_zalloc().
Restrict access to SCSI bsg device nodes so only trusted administrative accounts can issue FRU/I2C operations.

Patch Information

The fix replaces dma_pool_alloc() with dma_pool_zalloc() in all five FRU/I2C bsg handlers, ensuring bytes beyond the initialized prefix are zero rather than stale heap contents. Patches are available across mainline and stable branches:

Workarounds

Deny non-root users access to /dev/bsg/* nodes associated with qla2xxx HBAs via udev rules or filesystem permissions.
Disallow loading of the qla2xxx module on systems that do not require QLogic Fibre Channel connectivity.
Constrain administrative tooling that issues FRU/SFP writes to change-controlled maintenance windows.