CVE-2026-89846 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
A malicious storage target can trigger an out-of-bounds read in the qla2xxx driver, leaking kernel memory into the sense buffer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89846?
CVE-2026-89846 is a critical vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len:
if (IS_FWI2_CAPABLE(ha)) { sense_data += rsp_info_len; par_sense_len -= rsp_info_len; }
rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds.
The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense():
if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len);
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer.
Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites.
Which versions are affected by CVE-2026-89846?
How do I fix CVE-2026-89846?
Apply the vendor's patch.
Is CVE-2026-89846 being exploited?
There is no known exploitation of CVE-2026-89846 in the wild and no public exploit code.
Sources
Also known as AZL-101637, BELL-CVE-2026-89846, DEBIAN-CVE-2026-89846, GHSA-w8mp-89wx-m5rw, UBUNTU-CVE-2026-89846.