CVE-2026-89856

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the scsi qla2xxx driver where MSI-X derived queue counts are not properly clamped, leading to integer truncation. Specifically, ha->msix count is a u16 type, while ha->max req queues, ha->max rsp queues, and ha->max qpairs are u8. When a device advertises a specific number of MSI-X vectors (e.g., 257), the calculation ha->msix count - 1 results in a value that truncates to 0. In target mode, a subsequent decrement can cause an underflow from 0 to 255.

When the count is 0, the qla2x00 alloc queues() function calls kzalloc objs() with a size of 0, returning ZERO SIZE PTR. Because this is not NULL, the allocation check passes, and the subsequent assignment to ha->req q map[0] dereferences the ZERO SIZE PTR, which can lead to memory corruption or a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.