CVE-2026-89858scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before af733bbfcf667af1871a2735fba2835b0da71efb; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before a9706d5e754e77515a92bb532bd0d73644979a1f; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 7e3154c97ec15460f715dbbe4097c255cce110b1; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 047f1f7ee6f85bde28abfdda9fa550191ddc0532; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before f93e8039e6fd54a3c027c6184daf00b745b576a0; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 7b22b4cb8822805cef7ba618da6f76e1474d68bd; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before de62cf265dbe309f34f144a6cdbca9240317727e | CNA record |
References
- https://git.kernel.org/stable/c/af733bbfcf667af1871a2735fba2835b0da71efb
- https://git.kernel.org/stable/c/a9706d5e754e77515a92bb532bd0d73644979a1f
- https://git.kernel.org/stable/c/7e3154c97ec15460f715dbbe4097c255cce110b1
- https://git.kernel.org/stable/c/047f1f7ee6f85bde28abfdda9fa550191ddc0532
- https://git.kernel.org/stable/c/f93e8039e6fd54a3c027c6184daf00b745b576a0
- https://git.kernel.org/stable/c/7b22b4cb8822805cef7ba618da6f76e1474d68bd
- https://git.kernel.org/stable/c/f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514
- https://git.kernel.org/stable/c/de62cf265dbe309f34f144a6cdbca9240317727e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.