CVE-2026-89858
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer.
INFO
Published Date :
Sept. 16, 2026, 11:16 a.m.
Last Modified :
Sept. 16, 2026, 11:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Validate the count against the buffer size.
- Reject requests with oversized counts.
- Ensure image pointer stays within bounds.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89858.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89858 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89858
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89858 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89858 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89858.json">CVE-2026-89858</a> Added Reference https://git.kernel.org/stable/c/047f1f7ee6f85bde28abfdda9fa550191ddc0532 Added Reference https://git.kernel.org/stable/c/7b22b4cb8822805cef7ba618da6f76e1474d68bd Added Reference https://git.kernel.org/stable/c/7e3154c97ec15460f715dbbe4097c255cce110b1 Added Reference https://git.kernel.org/stable/c/a9706d5e754e77515a92bb532bd0d73644979a1f Added Reference https://git.kernel.org/stable/c/af733bbfcf667af1871a2735fba2835b0da71efb Added Reference https://git.kernel.org/stable/c/de62cf265dbe309f34f144a6cdbca9240317727e Added Reference https://git.kernel.org/stable/c/f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514 Added Reference https://git.kernel.org/stable/c/f93e8039e6fd54a3c027c6184daf00b745b576a0