Not yet scoredPublished Sep 16, 2026

CVE-2026-89858scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

Updated under an hour ago (Oct 28, 2026, 3:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before af733bbfcf667af1871a2735fba2835b0da71efb; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before a9706d5e754e77515a92bb532bd0d73644979a1f; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 7e3154c97ec15460f715dbbe4097c255cce110b1; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 047f1f7ee6f85bde28abfdda9fa550191ddc0532; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before f93e8039e6fd54a3c027c6184daf00b745b576a0; 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 builds before 7b22b4cb8822805cef7ba618da6f76e1474d68bd; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514; from 697a4bc69159c3396035b0506ffa55c4b2d0b1f4 before de62cf265dbe309f34f144a6cdbca9240317727e	CNA record

References

References

https://git.kernel.org/stable/c/af733bbfcf667af1871a2735fba2835b0da71efb
https://git.kernel.org/stable/c/a9706d5e754e77515a92bb532bd0d73644979a1f
https://git.kernel.org/stable/c/7e3154c97ec15460f715dbbe4097c255cce110b1
https://git.kernel.org/stable/c/047f1f7ee6f85bde28abfdda9fa550191ddc0532
https://git.kernel.org/stable/c/f93e8039e6fd54a3c027c6184daf00b745b576a0
https://git.kernel.org/stable/c/7b22b4cb8822805cef7ba618da6f76e1474d68bd
https://git.kernel.org/stable/c/f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514
https://git.kernel.org/stable/c/de62cf265dbe309f34f144a6cdbca9240317727e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.