CVE-2026-89846

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

In qla2x00_status_entry(), the FWI2 status path advances sense_data and

shrinks par_sense_len by rsp_info_len:

if (IS_FWI2_CAPABLE(ha)) {

sense_data += rsp_info_len;

par_sense_len -= rsp_info_len;

}

rsp_info_len is a 32-bit value taken directly from the target's FCP

response (sf.rsp_data_len), while par_sense_len is the IOCB data area

size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target

reporting an rsp_info_len larger than par_sense_len makes the unsigned

subtraction underflow to a huge value and advances sense_data out of

bounds.

The underflowed par_sense_len then defeats the cap in

qla2x00_handle_sense():

if (sense_len > par_sense_len)

sense_len = par_sense_len;

memcpy(cp->sense_buffer, sense_data, sense_len);

so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the

out-of-bounds sense_data pointer, leaking adjace

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References