Look up another CVE · open CVE-2026-89856 in the interactive tracker
CVE-2026-89856
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/scsi. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89856 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and ha->max_qpairs are u8. Deriving the queue count as "ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board (or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X count of 1 zeroes it as well, and in target mode the subsequent "ha->max_req_queues--" then underflows 0 to 255. When the count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is not NULL, so the allocation check passes and the following "ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory or crashing the kernel. Add qla_calc_queue_count() to clamp the derived value into [1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and use it at all three derivation sites (qla25xx_iospace_config(), qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the target-mode decrement so it cannot reintroduce a zero (which would in turn underflow max_qpairs).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/scsi/qla2xxx/qla_inline.h
drivers/scsi/qla2xxx/qla_isr.c
drivers/scsi/qla2xxx/qla_os.c
- What this is
- QLOGIC QLA2XXX FC-SCSI DRIVERMAINTAINERS section matched on drivers/scsi/qla2xxx/ · linux-scsi@vger.kernel.org · Supported
- Kernel module
- qla2xxx
Check it on the machine
grep -w CONFIG_SCSI_QLA_FC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w qla2xxxPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- trixieMnot built on amd64/cloud-amd64, arm64/cloud-arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, s390x/s390x
- forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_SCSI_QLA_FC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/scsi
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.10 | 5.10.270 | cf623d32761b |
| 4.10 | 5.15.221 | 9eeddbeaa896 |
| 4.10 | 6.1.188 | 802068b9b683 |
| 4.10 | 6.6.157 | e80adfeac61b |
| 4.10 | 6.12.110 | 2efe50b2da82 |
| 4.10 | 6.18.51 | 7a448f5ed0b2 |
| 4.10 | 7.2.5 | 33c77254e6e9 |
| 4.10 | 7.3 | ebfd35c64433 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is in qla2xxx PCI probe (qla2x00_probe_one → iospace_config/qla24xx_enable_msix → qla2x00_alloc_queues). QLogic FC HBAs are local PCI devices in storage servers, blades, and SAN hosts; a board or compromised adapter advertising a truncating MSI-X count triggers it at bind. Not a network/FC-frame path; local PCI is higher severity than physical hotplug.
- AC:LAttack complexity, low
- The attacker-controlled PCI MSI-X vector count (config word or pci_msix_vec_count) is stored in u8 max_req_queues. Advertising 1 or 257+ vectors deterministically truncates that count to 0 and underflows max_qpairs to 255; no race or uninfluenced layout is required.
- PR:NPrivileges required, none
- Probe reads the MSI-X count from the adapter and autoloads qla2xxx on matching QLogic PCI IDs with no capability or credential check. A malicious, misconfigured, or firmware-compromised HBA needs no Linux account or init-namespace privilege.
- UI:NUser interaction, none
- qla2x00_probe_one runs automatically on PCI enumeration at boot or hotplug bind; no victim must mount a filesystem, open a device node, or otherwise interact.
- S:UScope, unchanged
- The ZERO_SIZE_PTR store and any resulting oops or privilege escalation remain in the host kernel qla2xxx probe path, the same security authority. This is not a VM escape or IOMMU/DMA boundary bypass.
- C:HConfidentiality impact, high
- qla2x00_alloc_queues() writes request/response queue pointers through ZERO_SIZE_PTR and can desynchronize u8 queue maps versus MSI-X arrays (0 versus underflowed 255 qpairs). That kernel memory corruption can be leveraged for information disclosure.
- I:HIntegrity impact, high
- The wild write of kernel pointers through ZERO_SIZE_PTR, plus the u8 underflow that sizes queue-pair maps to 255 while the request map is a zero-size sentinel, is an out-of-bounds write exploitable for corruption and control-flow hijacking.
- A:HAvailability impact, high
- Dereferencing ZERO_SIZE_PTR is defined to take a distinct access fault, so a malicious MSI-X count causes a kernel oops or panic during probe.