CVE-2026-89865

A flaw was found in the Linux kernel's qla2xxx SCSI driver. The FRU and I2C bsg handlers, responsible for data transfers, utilize a DMA (Direct Memory Access) buffer that is not fully cleared upon allocation. A local attacker could exploit this by manipulating the transfer length in the qla2x00_write_sfp() function. This manipulation causes the hardware to read and write uninitialized memory from the DMA buffer to the device flash, potentially disclosing sensitive information from stale kernel heap memory.

qla2xxx FRU and I2C bsg handlers allocate a 256 byte DMA bounce buffer with dma_pool_alloc and initialize only a small prefix before passing it to qla2x00_write_sfp. A local actor with access to the qla2xxx bsg interface can influence the transfer length through the first payload byte, causing the device to DMA read beyond the initialized region and write stale DMA pool heap bytes into device flash. For the CVSS the PR:L is used because reliable triggering requires local access to the bsg device or an equivalent delegated storage management path, but not necessarily full administrator control of the host. The issue is not network reachable through packet traffic and requires local control plane access to the Fibre Channel adapter interface. Impact is at least kernel memory exposure to the device and persistent device data corruption, with possible confidentiality and integrity impact if the flash contents can be read back or if the leaked heap bytes contain sensitive kernel data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.