CVE-2026-89856

Status: UPDATED  |  Advisory ID: CVE-2026-89856

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and

ha->max_qpairs are u8. Deriving the queue count as

"ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board

(or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X

vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X

count of 1 zeroes it as well, and in target mode the subsequent

"ha->max_req_queues--" then underflows 0 to 255.

When the count is 0, qla2x00_alloc_queues() calls

kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is

not NULL, so the allocation check passes and the following

"ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory

or crashing the kernel.

Add qla_calc_queue_count() to clamp the derived value into

[1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and

use it at all three derivation sites (qla25xx_iospace_config(),

qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the

target-mode decrement so it cannot reintroduce a zero (which would in

turn underflow max_qpairs). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References