CVE-2026-89859scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space. Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ec89146215d124c429bff84b498dccdc4919ffa7 before 5dfc77099c7d9fde9520a229794b0154d7ccccc1; from ec89146215d124c429bff84b498dccdc4919ffa7 before d6e2411516bb95e52cb74c9c56b60ad2548a2730; from ec89146215d124c429bff84b498dccdc4919ffa7 before 9fc03be982763a131913f84fe73b240ae45bca37; from ec89146215d124c429bff84b498dccdc4919ffa7 before a152edab3854f01dd2daf3eaf8f32cbabdb3834e | CNA record |
References
- https://git.kernel.org/stable/c/5dfc77099c7d9fde9520a229794b0154d7ccccc1
- https://git.kernel.org/stable/c/d6e2411516bb95e52cb74c9c56b60ad2548a2730
- https://git.kernel.org/stable/c/9fc03be982763a131913f84fe73b240ae45bca37
- https://git.kernel.org/stable/c/a152edab3854f01dd2daf3eaf8f32cbabdb3834e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.