CVE-2026-89852scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4d4df1932b6b116aecc81039066fec27f2050762 before f8fc5cc6b3284506c6ab83c822c48133377668bb; from 4d4df1932b6b116aecc81039066fec27f2050762 before f29695b1138ae2539c5cd6cdaba9b1b072aaa81a; from 4d4df1932b6b116aecc81039066fec27f2050762 before 13d645a2cdb224d27205368f3e3c68bb160daf97; 4d4df1932b6b116aecc81039066fec27f2050762 builds before 2f847f06bb223aa895eea91fc9e5e2d6314038eb; 4d4df1932b6b116aecc81039066fec27f2050762 builds before 1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79; from 4d4df1932b6b116aecc81039066fec27f2050762 before e6cfb1ee18336aab41a0941d6d3ea5009aaafc05; from 4d4df1932b6b116aecc81039066fec27f2050762 before 9f31de4d07e4cde91dfc24522993a5fbb4d67083; from 4d4df1932b6b116aecc81039066fec27f2050762 before 9efaa782845b4d5fb3e01242be0d06ebc7428d8f | CNA record |
References
- https://git.kernel.org/stable/c/f8fc5cc6b3284506c6ab83c822c48133377668bb
- https://git.kernel.org/stable/c/f29695b1138ae2539c5cd6cdaba9b1b072aaa81a
- https://git.kernel.org/stable/c/13d645a2cdb224d27205368f3e3c68bb160daf97
- https://git.kernel.org/stable/c/2f847f06bb223aa895eea91fc9e5e2d6314038eb
- https://git.kernel.org/stable/c/1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79
- https://git.kernel.org/stable/c/e6cfb1ee18336aab41a0941d6d3ea5009aaafc05
- https://git.kernel.org/stable/c/9f31de4d07e4cde91dfc24522993a5fbb4d67083
- https://git.kernel.org/stable/c/9efaa782845b4d5fb3e01242be0d06ebc7428d8f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.