CVE-2026-89859

scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space.

Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ec89146215d124c429bff84b498dccdc4919ffa7 to before eeef4fa993b3f962de9b45999f12ff25a5c79ce7Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before 504b177ad58c45be7e1cfa81f9b42f7f040737c5Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before c3e4c716909a053391b06a9a816c8588b652e3d2Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before 2ecc30066c2284d2ed11bbd576ec97156b384054Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before 5dfc77099c7d9fde9520a229794b0154d7ccccc1Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before d6e2411516bb95e52cb74c9c56b60ad2548a2730Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before 9fc03be982763a131913f84fe73b240ae45bca37Affected ec89146215d124c429bff84b498dccdc4919ffa7 to before a152edab3854f01dd2daf3eaf8f32cbabdb3834eAffected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ec89146215d124c429bff84b498dccdc4919ffa7 to before eeef4fa993b3f962de9b45999f12ff25a5c79ce7Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before 504b177ad58c45be7e1cfa81f9b42f7f040737c5Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before c3e4c716909a053391b06a9a816c8588b652e3d2Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before 2ecc30066c2284d2ed11bbd576ec97156b384054Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before 5dfc77099c7d9fde9520a229794b0154d7ccccc1Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before d6e2411516bb95e52cb74c9c56b60ad2548a2730Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before 9fc03be982763a131913f84fe73b240ae45bca37Affected
ec89146215d124c429bff84b498dccdc4919ffa7 to before a152edab3854f01dd2daf3eaf8f32cbabdb3834eAffected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.