CVE-2026-89852

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.

Is your site exposed to CVE-2026-89852?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.11%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/13d645a2cdb224d27205368f3e3c68bb160daf97 https://git.kernel.org/stable/c/1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79 https://git.kernel.org/stable/c/2f847f06bb223aa895eea91fc9e5e2d6314038eb https://git.kernel.org/stable/c/9efaa782845b4d5fb3e01242be0d06ebc7428d8f https://git.kernel.org/stable/c/9f31de4d07e4cde91dfc24522993a5fbb4d67083 https://git.kernel.org/stable/c/e6cfb1ee18336aab41a0941d6d3ea5009aaafc05 https://git.kernel.org/stable/c/f29695b1138ae2539c5cd6cdaba9b1b072aaa81a https://git.kernel.org/stable/c/f8fc5cc6b3284506c6ab83c822c48133377668bb

Frequently Asked Questions

What is CVE-2026-89852? +

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.

How do I check if I'm vulnerable to CVE-2026-89852? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.