CVE-2026-89859
Description
AI Translation Available
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response
buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full
sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound
sg_copy_to_buffer() only fills as many bytes as the user request payload
provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The
options and unused[] fields are therefore copied out uninitialized,
leaking kernel heap contents to user space.
Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().
https://git.kernel.org/stable/c/9fc03be982763a131913f84fe73b240ae45bca37
https://git.kernel.org/stable/c/a152edab3854f01dd2daf3eaf8f32cbabdb3834e
https://git.kernel.org/stable/c/d6e2411516bb95e52cb74c9c56b60ad2548a2730