{"id":"CVE-2026-89846","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_inf…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_inf…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < 125b12861c726e58448bb95d55b04851fb131d1f","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < e57ace988bda5693f7b3645f652ea4b4220870ee","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < 6b08c0cb110a1fba92f99d655020198489699815","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < be75ab791c9b3baca66c70ce03443afebc83acda","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < ebc41dfc59d190956e0113e8bd90c28f6f21e8b9","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < d7f7746ff031ae45724881261804f4bf5317c985","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < f6e8977bce887481b2b2b0e2e14a791270741cfb","Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < ca6d880d6c70cb7946e7b3e05d7285f271b6d99e","Linux 2.6.36"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:12.823","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89846","references":[{"url":"https://git.kernel.org/stable/c/125b12861c726e58448bb95d55b04851fb131d1f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b08c0cb110a1fba92f99d655020198489699815","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be75ab791c9b3baca66c70ce03443afebc83acda","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7f7746ff031ae45724881261804f4bf5317c985","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e57ace988bda5693f7b3645f652ea4b4220870ee","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebc41dfc59d190956e0113e8bd90c28f6f21e8b9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6e8977bce887481b2b2b0e2e14a791270741cfb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89846.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89846"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535391"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89846"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89846"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:71213"},{"url":"https://access.redhat.com/errata/RHSA-2026:71016"},{"url":"https://access.redhat.com/errata/RHSA-2026:74428"},{"url":"https://access.redhat.com/errata/RHSA-2026:88687"},{"url":"https://access.redhat.com/errata/RHSA-2026:71233"},{"url":"https://access.redhat.com/errata/RHSA-2026:71232"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"ingestedAt":"2026-09-16T10:53:53.995Z","epss":0.00714,"epssPercentile":0.53476,"patched":["enterprise_linux_baseos_v_8","enterprise_linux_crb_v_8","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"cwe":["CWE-125"],"scores":{"nvd":9.1,"vendor":7.1,"cna":9.1},"slug":"CVE-2026-89846","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_info_len:\n\n\tif (IS_FWI2_CAPABLE(ha)) {\n\t\tsense_data += rsp_info_len;\n\t\tpar_sense_len -= rsp_info_len;\n\t}\n\nrsp_info_len is a 32-bit value taken directly from the target's FCP\nresponse (sf.rsp_data_len), while par_sense_len is the IOCB data area\nsize (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target\nreporting an rsp_info_len larger than par_sense_len makes the unsigned\nsubtraction underflow to a huge value and advances sense_data out of\nbounds.\n\nThe underflowed par_sense_len then defeats the cap in\nqla2x00_handle_sense():\n\n\tif (sense_len > par_sense_len)\n\t\tsense_len = par_sense_len;\n\tmemcpy(cp->sense_buffer, sense_data, sense_len);\n\nso the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the\nout-of-bounds sense_data pointer, leaking adjacent response-ring/heap\nmemory into the command's sense buffer.\n\nClamp rsp_info_len to par_sense_len before the subtraction so\npar_sense_len can never underflow and sense_data stays within the IOCB\ndata area. The fix sits before the comp_status switch, covering both\nqla2x00_handle_sense() call sites.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:71213** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71213)\n- **RHSA-2026:71016** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71016)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89846.json)\n- **RHSA-2026:74428** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74428)\n- **RHSA-2026:88687** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88687)\n- **RHSA-2026:71233** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71233)\n- **RHSA-2026:71232** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71232)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":205206,"id":"CVE-2026-89846","ts":1789570705725,"field":"cvss","old":null,"new":"9.1"},{"seq":205205,"id":"CVE-2026-89846","ts":1789570705725,"field":"severity","old":"none","new":"critical"}]}