SB2026091799 - Out-of-bounds write in Linux kernel scsi qla2xxx driver
Published: September 17, 2026
Security Bulletin ID
SB2026091799
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds write (CVE-ID: CVE-2026-89864)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to corrupt kernel heap and stack memory.
The vulnerability exists due to improper bounds checking in the qla2x00_write_i2c() and qla2x00_read_i2c() I2C BSG handlers when processing a user-supplied I2C length. A local privileged user can submit a crafted I2C BSG request with an oversized length to corrupt kernel heap and stack memory.
Exploitation requires CAP_SYS_RAWIO.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59
- https://git.kernel.org/stable/c/2be39946abcde5a6416fb074ef728429e246a996
- https://git.kernel.org/stable/c/32d6df14fdab71fe1ba304fd9a0db0411ea2e043
- https://git.kernel.org/stable/c/47049fdadc0eaa115e813735b827e1379c0d2cf8
- https://git.kernel.org/stable/c/522d6dcdc645d8f97d6b4cdfd6d8eea307f3ff0e
- https://git.kernel.org/stable/c/8f01f886cc5e7bbc16cbf1a9928fdebbc911e973
- https://git.kernel.org/stable/c/97ca58b0fb026799b99e3d552d5f69cf9a3113ad
- https://git.kernel.org/stable/c/9a756f277eb89f769dbf380f38245c270d31fdb5