9.1

CVE-2026-89846: linux

CVSS: 9.1v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-89846DEBIAN-CVE-2026-89846
Published 16-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89846 is a critical (CVSS 9.1) vulnerability in linux. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.71%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 1
MGASA-2026-0506OPENSUSE-SU-2026:11880-1RHSA-2026:71016RHSA-2026:71213RHSA-2026:71232RHSA-2026:71233

Timeline

  1. 16-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPABLE(ha)) { sense_data += rsp_info_len; par_sense_len -= rsp_info_len; } rsp_info_len is a 32-bit value taken directly from the target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds. The underflowed par_sense_len then defeats the cap in qla2x00_handle_sense(): if (sense_len > par_sense_len) sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len); so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap memory into the command's sense buffer. Clamp rsp_info_len to par_sense_len before the subtraction so par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the comp_status switch, covering both qla2x00_handle_sense() call sites.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

+0.02 pp

From 0.69% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < 125b12861c726e58448bb95d55b04851fb131d1f | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < e57ace988bda5693f7b3645f652ea4b4220870ee | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < 6b08c0cb110a1fba92f99d655020198489699815 | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < be75ab791c9b3baca66c70ce03443afebc83acda | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < ebc41dfc59d190956e0113e8bd90c28f6f21e8b9 | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < d7f7746ff031ae45724881261804f4bf5317c985 | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < f6e8977bce887481b2b2b0e2e14a791270741cfb | ≥ 5544213be7b4fb693730106a6d70a8cc1aa7cdf6, < ca6d880d6c70cb7946e7b3e05d7285f271b6d99e | 2.6.36

3 vendors · 172 products

References

13 links
Show all 13 references