CVE-2026-89864

A flaw was found in the qla2xxx SCSI driver in the Linux kernel. This vulnerability allows a local attacker, with CAP_SYS_RAWIO capabilities, to cause heap and kernel stack corruption due to unbounded length fields in I2C bsg handlers. Successful exploitation could lead to privilege escalation or arbitrary code execution within the kernel.

The qla2xxx I2C BSG handlers used a user supplied 16 bit length with fixed size stack and DMA buffers. In the write path an oversized length can over read the on stack qla_i2c_access buffer and overwrite the 256 byte sfp DMA buffer before an oversized DMA transfer. In the read path an oversized length can DMA beyond the 256 byte sfp buffer and then overflow the 64 byte buffer inside the on stack request object. For the CVSS the PR:L is used in the paranoid score because CAP_SYS_RAWIO or delegated bsg device access may be available to a restricted local service or reduced capability administrator rather than only full root. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.