Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89843— scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： SCSI: qla2xxx：对 bsg 栈缓冲区进行零初始化，以避免信息泄露 多个 bsg 处理函数将在栈上分配的、未初始化的 256 字节缓冲区（ ）用于暂存请求/响应，并通过 填充该缓冲区。该函数仅复制用户提供的请求负载所含的字节数。当请求负载短于目标结构时，缓冲区的其余部分仍保留着过期的栈数据。 和 随后通过 将整个结构体复制回响应负载，从而将未初始化的栈字节泄露至用户空间。虽然写入/更新路径不会将缓冲区复制回用户空间，但可能会将未初始化的字段传递给设备。 修复方式是

AI Predicted 3.3 Difficulty: Hard EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 1c820d0900e4aacd5020b989159f6b4b2f7d0d6a affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 26bc6a2c235a70bfc9b6de412600208aca820e20 affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 5ab32dff910291b5e6bf6223f8a4003536c1800a affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 947c6bfcf7f5ec924995bec43e3108b98c75b44e affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 708c0ec1e09c52fee24b74ce9398bf3f8d1c83fd affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 4fe5790674097897a1af1367d1e384f7e5a62fb7 affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< 7881faf862ee301ecfe3adc0725bd2fa0021cd95 affected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4< b93d3bb3afe1b44489927de1eb4e66e8536a5935 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89843

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) and fill it via sg_copy_to_buffer(), which only copies as many bytes as the user-supplied request payload. When the request is shorter than the structure, the remainder of the buffer is left holding stale stack data. qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full structure back to the reply payload with sg_copy_from_buffer(), leaking the uninitialized stack bytes to user space. The write/update paths do not copy the buffer back, but can feed uninitialized fields to the device. Zero the stack buffer at declaration in all five handlers, mirroring the heap kzalloc() approach, so short requests can no longer expose stale memory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 ~ 1c820d0900e4aacd5020b989159f6b4b2f7d0d6a -
Linux Linux 3.2 -

II. Public POCs for CVE-2026-89843

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89843

请登录查看更多情报信息。

Other References for CVE-2026-89843 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89843

No comments yet

Leave a comment