CVE-2026-89852

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the qla2xxx SCSI driver where the mbx cmd t structure is allocated on the stack but remains uninitialized. The qla2x00 mailbox command() function contains multiple early-return paths—such as PCI permanent failure, device failure, EEH busy, ISP abort pending, mailbox access timeout, and purge mbox—that return without writing input mailbox registers into mcp->mb[]. Subsequently, qla2x00 get firmware state() unconditionally copies mcp->mb[1..6] and mb[12] into the states[] array. This process can leak uninitialized kernel stack memory to userspace through the fw state and mpi fw state sysfs handlers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.