{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89864 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89864 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89864 and fix it if it is affected.\n\nWhat it is: CVE-2026-89864 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89864 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89864/ (Markdown: https://insights.sbomify.com/CVE-2026-89864/index.md)","id":"CVE-2026-89864","markdown":"https://insights.sbomify.com/CVE-2026-89864/index.md","name":"CVE-2026-89864","record":{"aliases":["AZL-101558","BELL-CVE-2026-89864","DEBIAN-CVE-2026-89864","GHSA-vhpc-fmr8-vgcc","UBUNTU-CVE-2026-89864"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"high_privilege","summary":"A local attacker with CAP_SYS_RAWIO can trigger a buffer overflow in the qla2xxx SCSI driver, leading to kernel memory corruption and potential privilege escalation.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound i2c-\u003elength in I2C bsg handlers\n\nstruct qla_i2c_access carries a 16-bit length field alongside a fixed\n64-byte buffer:\n\n\tstruct qla_i2c_access {\n\t\tuint16_t device, offset, option, length;\n\t\tuint8_t  buffer[0x40];\n\t} __packed;\n\nqla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied\ni2c-\u003elength without any bounds check. i2c is overlaid on a 256-byte\non-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to\n65535 overruns both:\n\n  - write: memcpy(sfp, i2c-\u003ebuffer, i2c-\u003elength) over-reads the stack and\n    over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs\n    i2c-\u003elength bytes out of the 256-byte buffer.\n  - read: qla2x00_read_sfp() DMAs i2c-\u003elength bytes into the 256-byte sfp,\n    then memcpy(i2c-\u003ebuffer, sfp, i2c-\u003elength) overflows the 64-byte\n    buffer inside the on-stack array.\n\nA caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the\nkernel stack. Reject requests whose length exceeds the buffer before any\ncopy or DMA transfer in both handlers.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: qla2xxx: Bound i2c-\u003elength in I2C bsg handlers","id":"CVE-2026-89864","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers","id":"CVE-2026-89865"},"packages":[],"prev":{"headline":"scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check","id":"CVE-2026-89863"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker with CAP_SYS_RAWIO can trigger a buffer overflow in the qla2xxx SCSI driver, leading to kernel memory corruption and potential privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-89864/"}