CVE-2026-89858

scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp().

Reject requests whose declared count does not fit in the buffer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before af733bbfcf667af1871a2735fba2835b0da71efbAffected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before a9706d5e754e77515a92bb532bd0d73644979a1fAffected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 7e3154c97ec15460f715dbbe4097c255cce110b1Affected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 047f1f7ee6f85bde28abfdda9fa550191ddc0532Affected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before f93e8039e6fd54a3c027c6184daf00b745b576a0Affected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 7b22b4cb8822805cef7ba618da6f76e1474d68bdAffected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514Affected 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before de62cf265dbe309f34f144a6cdbca9240317727eAffected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before af733bbfcf667af1871a2735fba2835b0da71efbAffected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before a9706d5e754e77515a92bb532bd0d73644979a1fAffected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 7e3154c97ec15460f715dbbe4097c255cce110b1Affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 047f1f7ee6f85bde28abfdda9fa550191ddc0532Affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before f93e8039e6fd54a3c027c6184daf00b745b576a0Affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before 7b22b4cb8822805cef7ba618da6f76e1474d68bdAffected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514Affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to before de62cf265dbe309f34f144a6cdbca9240317727eAffected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.