Not yet scoredPublished Sep 16, 2026

CVE-2026-89852scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

Updated under an hour ago (Oct 27, 2026, 9:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value. On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4d4df1932b6b116aecc81039066fec27f2050762 before f8fc5cc6b3284506c6ab83c822c48133377668bb; from 4d4df1932b6b116aecc81039066fec27f2050762 before f29695b1138ae2539c5cd6cdaba9b1b072aaa81a; from 4d4df1932b6b116aecc81039066fec27f2050762 before 13d645a2cdb224d27205368f3e3c68bb160daf97; 4d4df1932b6b116aecc81039066fec27f2050762 builds before 2f847f06bb223aa895eea91fc9e5e2d6314038eb; 4d4df1932b6b116aecc81039066fec27f2050762 builds before 1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79; from 4d4df1932b6b116aecc81039066fec27f2050762 before e6cfb1ee18336aab41a0941d6d3ea5009aaafc05; from 4d4df1932b6b116aecc81039066fec27f2050762 before 9f31de4d07e4cde91dfc24522993a5fbb4d67083; from 4d4df1932b6b116aecc81039066fec27f2050762 before 9efaa782845b4d5fb3e01242be0d06ebc7428d8f	CNA record

References

References

https://git.kernel.org/stable/c/f8fc5cc6b3284506c6ab83c822c48133377668bb
https://git.kernel.org/stable/c/f29695b1138ae2539c5cd6cdaba9b1b072aaa81a
https://git.kernel.org/stable/c/13d645a2cdb224d27205368f3e3c68bb160daf97
https://git.kernel.org/stable/c/2f847f06bb223aa895eea91fc9e5e2d6314038eb
https://git.kernel.org/stable/c/1f49e861c18caf8eef7f0ad9a2c5034f88a6ba79
https://git.kernel.org/stable/c/e6cfb1ee18336aab41a0941d6d3ea5009aaafc05
https://git.kernel.org/stable/c/9f31de4d07e4cde91dfc24522993a5fbb4d67083
https://git.kernel.org/stable/c/9efaa782845b4d5fb3e01242be0d06ebc7428d8f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.