CVE-2026-89864

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

struct qla_i2c_access carries a 16-bit length field alongside a fixed

64-byte buffer:

struct qla_i2c_access {

uint16_t device, offset, option, length;

uint8_t buffer[0x40];

} __packed;

qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied

i2c->length without any bounds check. i2c is overlaid on a 256-byte

on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to

65535 overruns both:

- write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and

over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs

i2c->length bytes out of the 256-byte buffer.

- read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,

then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte

buffer inside the on-stack array.

A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the

kerne

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References