---
id: CVE-2026-89859
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

  qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response
  buffer with kmalloc_obj() (non-zer…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

  qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response
  buffer with kmalloc_obj() (non-zer…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec89146215d124c429bff84b498dccdc4919ffa7 <
    9fc03be982763a131913f84fe73b240ae45bca37
  - >-
    Linux >= ec89146215d124c429bff84b498dccdc4919ffa7 <
    a152edab3854f01dd2daf3eaf8f32cbabdb3834e
  - Linux 4.8
published: '2026-09-16'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:27.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89859'
references:
  - url: 'https://git.kernel.org/stable/c/9fc03be982763a131913f84fe73b240ae45bca37'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a152edab3854f01dd2daf3eaf8f32cbabdb3834e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d6e2411516bb95e52cb74c9c56b60ad2548a2730'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00206
epssPercentile: 0.09432
ingestedAt: '2026-09-16T10:53:53.991Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak

qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response
buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full
sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound
sg_copy_to_buffer() only fills as many bytes as the user request payload
provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The
options and unused[] fields are therefore copied out uninitialized,
leaking kernel heap contents to user space.

Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.