CVE-2026-89858

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the qla2x00 update fru versions() function where a user-supplied BSG request is copied into a fixed 256-byte stack buffer. The function iterates based on the count variable, which is taken directly from user input without an upper bound. Because only 6 entries of the qla image version array fit in the buffer, a larger count value allows the image pointer to move beyond the stack buffer boundaries. This results in the reading of adjacent kernel stack memory, which is then sent to the device via the qla2x00 write sfp() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.