https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:41:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89852 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()</p> <p>The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp-&gt;mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp-&gt;mb[1..6] (and mb[12]) into the caller&#39;s states[] array regardless of the return value.</p> <p>On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()</p> <p>The mbx_cmd_t is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp-&gt;mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp-&gt;mb[1..6] (and mb[12]) into the caller&#39;s states[] array regardless of the return value.</p> <p>On such a failure the copied values are uninitialized kernel stack memory, which is then exposed to userspace via the fw_state and mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query yields deterministic zeroed state instead of leaking stack contents.</p> https://vulnerability.circl.lu/vuln/cve-2026-89852