CVE-2026-89846

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol (FCP) response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory information from the kernel's heap.

This vulnerability is rated as having Important impact because a malicious or compromised Fibre Channel target can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or denial of service. Exploitation is constrained to systems equipped with QLogic Fibre Channel host bus adapters utilizing the qla2xxx driver connected to an untrusted storage fabric. Systems lacking this specific storage hardware or operating within isolated, trusted storage networks are not exposed to untrusted FCP responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If QLogic Fibre Channel HBAs are not in use, the 'qla2xxx' kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file.

To blacklist the module:

1. Create a file named /etc/modprobe.d/blacklist-qla2xxx.conf with the following content: blacklist qla2xxx
2. Regenerate the initramfs to ensure the blacklist is applied during boot: sudo dracut -f -v (for RHEL 7/8/9) sudo mkinitcpio -P (for Arch-based systems, if applicable)
3. Reboot the system for the changes to take effect.

Warning: Blacklisting this module will disable functionality for QLogic Fibre Channel HBAs. Ensure that this hardware is not required before applying this mitigation. A system reboot is required for the changes to take effect.