CVE-2026-89846
largeOut-of-bounds read in Linux kernel qla2xxx Fibre Channel driver leaks kernel memory
An unsigned-integer underflow in the qla2xxx SCSI driver (the in-kernel driver for Marvell/QLogic Fibre Channel HBAs) enables an out-of-bounds read in qla2x00_status_entry(). A hostile or buggy Fibre Channel target reports an rsp_info_len larger than the 28-byte (24xx) or 60-byte (29xx) IOCB sense-data area; the par_sense_len subtraction underflows to a huge value, defeats the length cap in qla2x00_handle_sense(), and a memcpy copies up to SCSI_SENSE_BUFFERSIZE bytes from beyond the response ring/heap into the command's sense buffer. An attacker who controls a storage target (LUN) on the same FC fabric gains disclosure of adjacent kernel memory returned as sense data, with availability impact also flagged in the CVSS vector; practical exploitation requires a malicious or compromised target on the fabric rather than generic network access. Any Linux server using qla2xxx-based QLogic/Marvell FC HBAs is affected. No public PoC, CISA KEV listing, or confirmed in-the-wild exploitation is known.
What to do: Update to a kernel containing the upstream qla2x00_status_entry() rsp_info_len bounds fix as soon as your distribution backports it (no fixed version number is available in this data). Until patched, restrict Fibre Channel fabric membership to trusted arrays, remove unauthorized or unknown targets, and segment fabrics so untrusted devices cannot present LUNs to qla2xxx hosts. Note the practical attack path is a hostile FC target on the fabric, not remote exploitation over IP.
| Linux kernel qla2xxx SCSI driver (Marvell/QLogic 24xx and 29xx Fibre Channel HBAs) | All kernel versions containing the vulnerable qla2x00_status_entry() code; fixed by the upstream 'Bound rsp_info_len to avoid OOB sense-data read' patch (no fix |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPABLE(ha)) { sense_data += rsp_info_len; par_sense_len -= rsp_info_len; } rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds. The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense(): if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len); so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer. Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.