CVE-2026-89858

A flaw was found in the Linux kernel's qla2xxx driver. A local user could exploit this vulnerability by sending a specially crafted Block SCSI Generic (BSG) request with an excessively large image count. This could cause the system to read beyond the intended memory buffer, leading to the disclosure of sensitive information from the kernel's memory.

A bounds check is missing in qla2x00_update_fru_versions() for the user supplied BSG request count. The function copies the request into a fixed 256 byte stack buffer and then iterates over qla_image_version entries based on list count, so an oversized count can make the image pointer read beyond the stack buffer and pass adjacent kernel stack data to qla2x00_write_sfp(). For the CVSS the PR:L is used because a local user or process needs access to the qla2xxx BSG interface, but full host administration is not necessarily required in delegated storage environments. The issue is not network reachable and requires local access to the SCSI BSG control path on a system with affected qla2xxx hardware. Impact is at least local denial of service or device data corruption, and in the paranoid case it may expose kernel stack data if the written FRU or SFP data can be read back.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.