CVE-2026-89852

scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value.

On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4d4df1932b6b116aecc81039066fec27f2050762 to before f8fc5cc6b3284506c6ab83c822c48133377668bbAffected 4d4df1932b6b116aecc81039066fec27f2050762 to before f29695b1138ae2539c5cd6cdaba9b1b072aaa81aAffected 4d4df1932b6b116aecc81039066fec27f2050762 to before 13d645a2cdb224d27205368f3e3c68bb160daf97Affected 4d4df1932b6b116aecc81039066fec27f2050762 to before 2f847f06bb223aa895eea91fc9e5e2d6314038ebAffected 4d4df1932b6b116aecc81039066fec27f2050762 to before 1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79Affected 4d4df1932b6b116aecc81039066fec27f2050762 to before e6cfb1ee18336aab41a0941d6d3ea5009aaafc05Affected 4d4df1932b6b116aecc81039066fec27f2050762 to before 9f31de4d07e4cde91dfc24522993a5fbb4d67083Affected 4d4df1932b6b116aecc81039066fec27f2050762 to before 9efaa782845b4d5fb3e01242be0d06ebc7428d8fAffected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4d4df1932b6b116aecc81039066fec27f2050762 to before f8fc5cc6b3284506c6ab83c822c48133377668bbAffected
4d4df1932b6b116aecc81039066fec27f2050762 to before f29695b1138ae2539c5cd6cdaba9b1b072aaa81aAffected
4d4df1932b6b116aecc81039066fec27f2050762 to before 13d645a2cdb224d27205368f3e3c68bb160daf97Affected
4d4df1932b6b116aecc81039066fec27f2050762 to before 2f847f06bb223aa895eea91fc9e5e2d6314038ebAffected
4d4df1932b6b116aecc81039066fec27f2050762 to before 1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79Affected
4d4df1932b6b116aecc81039066fec27f2050762 to before e6cfb1ee18336aab41a0941d6d3ea5009aaafc05Affected
4d4df1932b6b116aecc81039066fec27f2050762 to before 9f31de4d07e4cde91dfc24522993a5fbb4d67083Affected
4d4df1932b6b116aecc81039066fec27f2050762 to before 9efaa782845b4d5fb3e01242be0d06ebc7428d8fAffected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.