CVE-2026-89859

A flaw was found in the qla2xxx SCSI driver within the Linux kernel. The qla2x00_do_dport_diagnostics() function allocates a diagnostics buffer without initializing all its fields. When this buffer is copied to user space, the uninitialized options and unused[] fields can leak sensitive kernel heap memory contents. A local attacker could exploit this vulnerability to obtain potentially confidential information.

A kernel heap information leak exists in the qla2xxx D_Port diagnostics BSG path because qla2x00_do_dport_diagnostics allocates the response object without zeroing it. The request copy may initialize only part of the structure and qla26xx_dport_diagnostics only clears dd buf, while the full response object is later copied back to user space. This can expose uninitialized options and unused fields from kernel heap memory to a local process with access to the qla2xxx BSG interface. For the CVSS the PR:L is used because reliable triggering requires local access to the device interface, but it does not necessarily require full system administrator privileges if such access is delegated to a storage service or device access group. The issue is not network reachable. Impact is information disclosure only, with no direct integrity or availability impact shown by the code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.