DEBIAN-CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read  In qla2x00statusentry(), the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen:   if (ISFWI2CAPABLE(ha)) { sensedata += rspinfolen; parsenselen -= rspinfolen; }  rspinfolen is a 32-bit value taken directly from the target's FCP response (sf.rspdatalen), while parsenselen is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rspinfolen larger than parsenselen makes the unsigned subtraction underflow to a huge value and advances sensedata out of bounds.  The underflowed parsenselen then defeats the cap in qla2x00handlesense():   if (senselen > parsenselen) senselen = parsenselen; memcpy(cp->sensebuffer, sensedata, senselen);  so the memcpy reads up to SCSISENSEBUFFERSIZE bytes from the out-of-bounds sensedata pointer, leaking adjacent response-ring/heap memory into the command's sense buffer.  Clamp rspinfolen to parsenselen before the subtraction so parsenselen can never underflow and sensedata stays within the IOCB data area. The fix sits before the compstatus switch, covering both qla2x00handle_sense() call sites.