Answer in brief
CVE-2026-89859 records a Unknown severity vulnerability in scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ec89146215d124c429bff84b498dccdc4919ffa7 <5dfc77099c7d9fde9520a229794b0154d7ccccc1 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <d6e2411516bb95e52cb74c9c56b60ad2548a2730 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <9fc03be982763a131913f84fe73b240ae45bca37 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <a152edab3854f01dd2daf3eaf8f32cbabdb3834e | 5dfc77099c7d9fde9520a229794b0154d7ccccc1, d6e2411516bb95e52cb74c9c56b60ad2548a2730, 9fc03be982763a131913f84fe73b240ae45bca37, a152edab3854f01dd2daf3eaf8f32cbabdb3834e |
| Linux/Linuxgeneric | 4.8 | Not reported |
| Linux/Linuxgeneric | >=ec89146215d124c429bff84b498dccdc4919ffa7 <9fc03be982763a131913f84fe73b240ae45bca37 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <a152edab3854f01dd2daf3eaf8f32cbabdb3834e | 9fc03be982763a131913f84fe73b240ae45bca37, a152edab3854f01dd2daf3eaf8f32cbabdb3834e |
| Linux/Linuxgeneric | >=ec89146215d124c429bff84b498dccdc4919ffa7 <d6e2411516bb95e52cb74c9c56b60ad2548a2730 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <9fc03be982763a131913f84fe73b240ae45bca37 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <a152edab3854f01dd2daf3eaf8f32cbabdb3834e | d6e2411516bb95e52cb74c9c56b60ad2548a2730, 9fc03be982763a131913f84fe73b240ae45bca37, a152edab3854f01dd2daf3eaf8f32cbabdb3834e |
| Linux/Linuxgeneric | >=ec89146215d124c429bff84b498dccdc4919ffa7 <2ecc30066c2284d2ed11bbd576ec97156b384054 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <5dfc77099c7d9fde9520a229794b0154d7ccccc1 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <d6e2411516bb95e52cb74c9c56b60ad2548a2730 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <9fc03be982763a131913f84fe73b240ae45bca37 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <a152edab3854f01dd2daf3eaf8f32cbabdb3834e | 2ecc30066c2284d2ed11bbd576ec97156b384054, 5dfc77099c7d9fde9520a229794b0154d7ccccc1, d6e2411516bb95e52cb74c9c56b60ad2548a2730, 9fc03be982763a131913f84fe73b240ae45bca37, a152edab3854f01dd2daf3eaf8f32cbabdb3834e |
| Linux/Linuxgeneric | >=ec89146215d124c429bff84b498dccdc4919ffa7 <eeef4fa993b3f962de9b45999f12ff25a5c79ce7 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <504b177ad58c45be7e1cfa81f9b42f7f040737c5 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <c3e4c716909a053391b06a9a816c8588b652e3d2 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <2ecc30066c2284d2ed11bbd576ec97156b384054 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <5dfc77099c7d9fde9520a229794b0154d7ccccc1 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <d6e2411516bb95e52cb74c9c56b60ad2548a2730 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <9fc03be982763a131913f84fe73b240ae45bca37 || >=ec89146215d124c429bff84b498dccdc4919ffa7 <a152edab3854f01dd2daf3eaf8f32cbabdb3834e | eeef4fa993b3f962de9b45999f12ff25a5c79ce7, 504b177ad58c45be7e1cfa81f9b42f7f040737c5, c3e4c716909a053391b06a9a816c8588b652e3d2, 2ecc30066c2284d2ed11bbd576ec97156b384054, 5dfc77099c7d9fde9520a229794b0154d7ccccc1, d6e2411516bb95e52cb74c9c56b60ad2548a2730, 9fc03be982763a131913f84fe73b240ae45bca37, a152edab3854f01dd2daf3eaf8f32cbabdb3834e |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space. Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().
Quoted source text, attributed separately from HOL analysis.