{"id":"CVE-2026-89852","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()\n\nThe mbx_cmd_t is allocated on the stack but left uninitialized.\nqla2x00_mailbox_command() has severa…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()\n\nThe mbx_cmd_t is allocated on the stack but left uninitialized.\nqla2x00_mailbox_command() has severa…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < f8fc5cc6b3284506c6ab83c822c48133377668bb","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < f29695b1138ae2539c5cd6cdaba9b1b072aaa81a","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < 13d645a2cdb224d27205368f3e3c68bb160daf97","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < 2f847f06bb223aa895eea91fc9e5e2d6314038eb","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < 1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < e6cfb1ee18336aab41a0941d6d3ea5009aaafc05","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < 9f31de4d07e4cde91dfc24522993a5fbb4d67083","Linux >= 4d4df1932b6b116aecc81039066fec27f2050762 < 9efaa782845b4d5fb3e01242be0d06ebc7428d8f","Linux 2.6.26"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:16:52.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89852","references":[{"url":"https://git.kernel.org/stable/c/13d645a2cdb224d27205368f3e3c68bb160daf97","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f847f06bb223aa895eea91fc9e5e2d6314038eb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9efaa782845b4d5fb3e01242be0d06ebc7428d8f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f31de4d07e4cde91dfc24522993a5fbb4d67083","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6cfb1ee18336aab41a0941d6d3ea5009aaafc05","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f29695b1138ae2539c5cd6cdaba9b1b072aaa81a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8fc5cc6b3284506c6ab83c822c48133377668bb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.993Z","epss":0.0021,"epssPercentile":0.11548,"slug":"CVE-2026-89852","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()\n\nThe mbx_cmd_t is allocated on the stack but left uninitialized.\nqla2x00_mailbox_command() has several early-return paths (PCI permanent\nfailure, device failed, EEH busy, ISP abort pending, mailbox access\ntimeout, purge mbox) that return without writing the input mailbox\nregisters back into mcp->mb[]. qla2x00_get_firmware_state() then\nunconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's\nstates[] array regardless of the return value.\n\nOn such a failure the copied values are uninitialized kernel stack\nmemory, which is then exposed to userspace via the fw_state and\nmpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query\nyields deterministic zeroed state instead of leaking stack contents.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}