CVE-2026-89865

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the qla2xxx SCSI driver where FRU and I2C bsg handlers use a 256-byte bounce buffer allocated via dma pool alloc(), which does not zero the memory. Because only a small portion of the buffer is initialized before being passed to the qla2x00 write sfp() function, a user-controlled value in the payload can manipulate the transfer length len up to 255 bytes. This allows the hardware to perform a DMA read that extends beyond the initialized region, resulting in up to approximately 219 bytes of stale DMA-pool heap memory being written to the device flash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.