CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read

In qla2x00statusentry(), the FWI2 status path advances sense_data and

shrinks parsenselen by rspinfolen:

if (ISFWI2CAPABLE(ha)) {

sensedata += rspinfo_len;

parsenselen -= rspinfolen;

}

rspinfolen is a 32-bit value taken directly from the target's FCP

response (sf.rspdatalen), while parsenselen is the IOCB data area

size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target

reporting an rspinfolen larger than parsenselen makes the unsigned

subtraction underflow to a huge value and advances sense_data out of

bounds.

The underflowed parsenselen then defeats the cap in

qla2x00handlesense():

if (senselen > parsense_len)

senselen = parsense_len;

memcpy(cp->sensebuffer, sensedata, sense_len);

so the memcpy reads up to SCSISENSEBUFFERSIZE bytes from the

out-of-bounds sense_data pointer, leaking adjacent response-ring/heap

memory into the command's sense buffer.

Clamp rspinfolen to parsenselen before the subtraction so

parsenselen can never underflow and sense_data stays within the IOCB

data area. The fix sits before the comp_status switch, covering both

qla2x00handlesense() call sites.