{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-89864",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-11T19:38:34.771Z",
        "datePublished": "2026-09-16T10:31:35.068Z",
        "dateUpdated": "2026-10-19T08:53:57.594Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-19T08:53:57.594Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound i2c->length in I2C bsg handlers\n\nstruct qla_i2c_access carries a 16-bit length field alongside a fixed\n64-byte buffer:\n\n\tstruct qla_i2c_access {\n\t\tuint16_t device, offset, option, length;\n\t\tuint8_t  buffer[0x40];\n\t} __packed;\n\nqla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied\ni2c->length without any bounds check. i2c is overlaid on a 256-byte\non-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to\n65535 overruns both:\n\n  - write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and\n    over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs\n    i2c->length bytes out of the 256-byte buffer.\n  - read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,\n    then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte\n    buffer inside the on-stack array.\n\nA caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the\nkernel stack. Reject requests whose length exceeds the buffer before any\ncopy or DMA transfer in both handlers."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/scsi/qla2xxx/qla_bsg.c"
                    ],
                    "versions": [
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "8f01f886cc5e7bbc16cbf1a9928fdebbc911e973",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "2be39946abcde5a6416fb074ef728429e246a996",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "522d6dcdc645d8f97d6b4cdfd6d8eea307f3ff0e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "9a756f277eb89f769dbf380f38245c270d31fdb5",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "32d6df14fdab71fe1ba304fd9a0db0411ea2e043",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "97ca58b0fb026799b99e3d552d5f69cf9a3113ad",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "47049fdadc0eaa115e813735b827e1379c0d2cf8",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "9ebb5d9c69f1f5721f9f6f49e501c674c1e184ae",
                            "lessThan": "0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/scsi/qla2xxx/qla_bsg.c"
                    ],
                    "versions": [
                        {
                            "version": "3.7",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "3.7",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.270",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.221",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.188",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.157",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.110",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.51",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.5",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "5.10.270"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "5.15.221"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "6.1.188"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "6.6.157"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "6.12.110"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "6.18.51"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "7.2.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.7",
                                    "versionEndExcluding": "7.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/8f01f886cc5e7bbc16cbf1a9928fdebbc911e973"
                },
                {
                    "url": "https://git.kernel.org/stable/c/2be39946abcde5a6416fb074ef728429e246a996"
                },
                {
                    "url": "https://git.kernel.org/stable/c/522d6dcdc645d8f97d6b4cdfd6d8eea307f3ff0e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9a756f277eb89f769dbf380f38245c270d31fdb5"
                },
                {
                    "url": "https://git.kernel.org/stable/c/32d6df14fdab71fe1ba304fd9a0db0411ea2e043"
                },
                {
                    "url": "https://git.kernel.org/stable/c/97ca58b0fb026799b99e3d552d5f69cf9a3113ad"
                },
                {
                    "url": "https://git.kernel.org/stable/c/47049fdadc0eaa115e813735b827e1379c0d2cf8"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59"
                }
            ],
            "title": "scsi: qla2xxx: Bound i2c->length in I2C bsg handlers",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}