--- id: CVE-2026-89846 title: |- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_inf… summary: |- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_inf… severity: critical cvss: 9.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H' vendor: Linux product: Linux affected: - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < 125b12861c726e58448bb95d55b04851fb131d1f - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < e57ace988bda5693f7b3645f652ea4b4220870ee - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < 6b08c0cb110a1fba92f99d655020198489699815 - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < be75ab791c9b3baca66c70ce03443afebc83acda - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < ebc41dfc59d190956e0113e8bd90c28f6f21e8b9 - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < d7f7746ff031ae45724881261804f4bf5317c985 - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < f6e8977bce887481b2b2b0e2e14a791270741cfb - >- Linux >= 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 < ca6d880d6c70cb7946e7b3e05d7285f271b6d99e - Linux 2.6.36 published: '2026-09-16' updated: '2026-09-16' sourceUpdated: '2026-09-16T15:18:12.823' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89846' references: - url: 'https://git.kernel.org/stable/c/125b12861c726e58448bb95d55b04851fb131d1f' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/6b08c0cb110a1fba92f99d655020198489699815' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/be75ab791c9b3baca66c70ce03443afebc83acda' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d7f7746ff031ae45724881261804f4bf5317c985' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/e57ace988bda5693f7b3645f652ea4b4220870ee' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/ebc41dfc59d190956e0113e8bd90c28f6f21e8b9' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f6e8977bce887481b2b2b0e2e14a791270741cfb' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89846.json - url: 'https://access.redhat.com/security/cve/CVE-2026-89846' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535391' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89846' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89846' - url: >- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox - url: 'https://access.redhat.com/errata/RHSA-2026:71213' - url: 'https://access.redhat.com/errata/RHSA-2026:71016' - url: 'https://access.redhat.com/errata/RHSA-2026:74428' - url: 'https://access.redhat.com/errata/RHSA-2026:88687' - url: 'https://access.redhat.com/errata/RHSA-2026:71233' - url: 'https://access.redhat.com/errata/RHSA-2026:71232' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute ingestedAt: '2026-09-16T10:53:53.995Z' epss: 0.00714 epssPercentile: 0.53476 patched: - enterprise_linux_baseos_v_8 - enterprise_linux_crb_v_8 - enterprise_linux_nfv_v_8 - enterprise_linux_rt_v_8 cwe: - CWE-125 scores: nvd: 9.1 vendor: 7.1 cna: 9.1 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPABLE(ha)) { sense_data += rsp_info_len; par_sense_len -= rsp_info_len; } rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds. The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense(): if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len); so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer. Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:71213** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71213) - **RHSA-2026:71016** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71016) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89846.json) - **RHSA-2026:74428** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74428) - **RHSA-2026:88687** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88687) - **RHSA-2026:71233** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71233) - **RHSA-2026:71232** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71232)