CVE-2026-89865: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-rqfh-jqm9-82qm
Share
Published
Advisory Summary

CVE-2026-89865 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89865 at a Glance

CVE Identifier CVE-2026-89865
GHSA Identifier GHSA-rqfh-jqm9-82qm
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89865

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89865, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE (256-byte) bounce buffer obtained from dma_pool_alloc(), which does not zero the allocation. They initialize only a few leading bytes before handing the buffer to qla2x00_write_sfp(). qla2x00_write_sfp() can override the transfer length with a user-supplied value: if (len == 1) opt |= BIT_0; if (opt & BIT_0) len = *sfp; *sfp is the first byte of the (user-controlled) payload, so len can grow up to 255. The device then DMA-reads len bytes from the 256-byte pool buffer. Since only a small prefix was written (e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU status register), the hardware reads past the initialized region and writes up to ~219 bytes of stale DMA-pool heap memory to the device flash. Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers so any bytes beyond the initialized data are zero rather than stale heap contents.

References

NVD — CVE-2026-89865 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89865
git.kernel.org/stable/c/09703bc7c0... WEB
https://git.kernel.org/stable/c/09703bc7c0be3a7a155b0ff5f21f6765ba3f519c
git.kernel.org/stable/c/581590f560... WEB
https://git.kernel.org/stable/c/581590f560b74399151b3cbc88574424c2f3d2dc
git.kernel.org/stable/c/84bde5ce40... WEB
https://git.kernel.org/stable/c/84bde5ce4038d9ad811e5c994305bbfcbd7a9f79
git.kernel.org/stable/c/97c45c75f5... WEB
https://git.kernel.org/stable/c/97c45c75f5cdec96b1a4fba8b1d55d0dd01af1e8
git.kernel.org/stable/c/a476377a66... WEB
https://git.kernel.org/stable/c/a476377a66897549dd49bee319f4df66623417b7
git.kernel.org/stable/c/a5501c4225... WEB
https://git.kernel.org/stable/c/a5501c42256235523c4dddf799f032dfbf4f4c77
git.kernel.org/stable/c/b157256c28... WEB
https://git.kernel.org/stable/c/b157256c28086c434afd70cc78bf9b4d8caf1276
git.kernel.org/stable/c/b47d4a1547... WEB
https://git.kernel.org/stable/c/b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc

Frequently Asked Questions

What is CVE-2026-89865?
CVE-2026-89865 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89865?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89865?
CVE-2026-89865 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89865?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rqfh-jqm9-82qm",
  "modified" : "2026-09-16T12:30:39Z",
  "published" : "2026-09-16T12:30:39Z",
  "aliases" : [ "CVE-2026-89865" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers\n\nThe FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE\n(256-byte) bounce buffer obtained from dma_pool_alloc(), which does not\nzero the allocation. They initialize only a few leading bytes before\nhanding the buffer to qla2x00_write_sfp().\n\nqla2x00_write_sfp() can override the transfer length with a user-supplied\nvalue:\n\n\tif (len == 1)\n\t\topt |= BIT_0;\n\tif (opt & BIT_0)\n\t\tlen = *sfp;\n\n*sfp is the first byte of the (user-controlled) payload, so len can grow\nup to 255. The device then DMA-reads len bytes from the 256-byte pool\nbuffer. Since only a small prefix was written\n(e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU\nstatus register), the hardware reads past the initialized region and\nwrites up to ~219 bytes of stale DMA-pool heap memory to the device\nflash.\n\nAllocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers\nso any bytes beyond the initialized data are zero rather than stale heap\ncontents.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89865"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/09703bc7c0be3a7a155b0ff5f21f6765ba3f519c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/581590f560b74399151b3cbc88574424c2f3d2dc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/84bde5ce4038d9ad811e5c994305bbfcbd7a9f79"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/97c45c75f5cdec96b1a4fba8b1d55d0dd01af1e8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a476377a66897549dd49bee319f4df66623417b7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a5501c42256235523c4dddf799f032dfbf4f4c77"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b157256c28086c434afd70cc78bf9b4d8caf1276"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:16:54Z"
  }
}