CVE-2026-89843

A flaw was found in the Linux kernel's scsi: qla2xxx component. This vulnerability arises in several block SCSI generic (bsg) handlers due to improper initialization of stack buffers when processing requests. A local attacker can exploit this by sending a specially crafted request, which causes uninitialized stack memory to be leaked to user space. This information disclosure could potentially expose sensitive data.

An uninitialized stack buffer in qla2xxx BSG handlers can expose stale kernel stack bytes to user space when a short request payload is copied into a 256 byte buffer and a full reply structure is copied back. The confirmed leak paths are qla2x00_read_fru_status() and qla2x00_read_i2c(), while write or update paths may also pass uninitialized fields to the device. For the CVSS the PR:L because the attacker needs local access to the qla2xxx BSG device node or equivalent SCSI BSG permissions, but does not need kernel privileges. The issue is not network reachable and requires a local process on a system with the affected qla2xxx driver and exposed BSG interface. Impact is at least local information disclosure of kernel stack data. In the paranoid interpretation, repeated stack disclosure may help bypass kernel mitigations or expose sensitive values, and limited integrity or availability impact is possible through uninitialized fields sent to the device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.