https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:35:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89859 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak</p> <p>qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd-&gt;buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space.</p> <p>Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak</p> <p>qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound sg_copy_to_buffer() only fills as many bytes as the user request payload provides, and qla26xx_dport_diagnostics() zeroes only dd-&gt;buf. The options and unused[] fields are therefore copied out uninitialized, leaking kernel heap contents to user space.</p> <p>Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().</p> https://vulnerability.circl.lu/vuln/cve-2026-89859