Executive brief
A vulnerability in the Linux kernel's Fibre Channel SCSI driver (qla2xxx) allows a malicious or malfunctioning storage target to trigger an out-of-bounds memory read. By crafting a response with an oversized field value, an attacker can cause the kernel to read sensitive data from adjacent memory regions and leak it back to the initiator, potentially exposing kernel memory contents or other sensitive information.
Technical details
The vulnerability exists in qla2x00_status_entry() within the qla2xxx driver's FWI2 status path. The code subtracts an untrusted 32-bit value (rsp_info_len) from a small buffer size (par_sense_len, which is 28 bytes for 24xx controllers or 60 bytes for 29xx). When rsp_info_len exceeds par_sense_len, unsigned integer underflow occurs, causing par_sense_len to become a huge value. The vulnerable memcpy operation then reads up to SCSI_SENSE_BUFFERSIZE bytes from an out-of-bounds pointer, leaking heap or response-ring memory. The fix clamps rsp_info_len to par_sense_len before subtraction, preventing the underflow. This is a network-adjacent vulnerability requiring a hostile Fibre Channel target on the same fabric.
Affected products
- Linux Linux kernel All versions containing commit 5544213be7b4 onwards (multiple stable series affected)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-07-30: patched: Fix committed upstream
- 2026-09-14: patched: Fix backported to stable kernel branches