CVE-2026-89864

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the scsi qla2xxx driver where the qla2x00 write i2c() and qla2x00 read i2c() functions fail to perform bounds checks on the user-supplied length variable within the qla i2c access structure. Because the length field is a 16-bit integer, it can hold values up to 65535, which exceeds the fixed 64-byte buffer and the 256-byte DMA-pool buffer. In write operations, this leads to a stack over-read and a heap buffer overwrite. In read operations, it results in a buffer overflow of the on-stack array. A user with CAP SYS RAWIO privileges can exploit this to corrupt the kernel stack and the heap.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.