Executive brief
The Linux kernel's Qlogic qla2xxx SCSI driver contains a pointer dereference vulnerability in its status message handler. When firmware sends an unexpected status message for a non-SCSI command, the code can follow a garbage pointer into invalid memory, causing a kernel crash. This affects systems using Qlogic SCSI adapters and can lead to denial of service.
Technical details
The vulnerability is a wild pointer dereference in qla2x00_status_entry() within drivers/scsi/qla2xxx/qla_isr.c. The function filters out some non-SCSI command types but falls through to a SCSI fast-path handler that assumes the command is type SRB_SCSI_CMD. The code then dereferences sp->u.scmd.cmd without verifying the SRB type matches SRB_SCSI_CMD. Since the srb union overlays different command layouts (SCSI, BSG, iocb), if firmware delivers a STATUS_TYPE IOCB for an unexpected command handle, the union member reads as garbage, bypassing NULL checks and causing a wild pointer dereference. The fix rejects any SRB whose type is not SRB_SCSI_CMD before entering the fast path. No authentication is required; the attack relies on malformed firmware responses or device state manipulation.
Affected products
- Linux Linux kernel versions prior to commit 0f41d07d72f2245208c45374ca8d0a1846cad667
Timeline
- 2026-09-16: disclosed
- 2026-08-06: patched: commit 0f41d07d72f2245208c45374ca8d0a1846cad667 merged to mainline
- 2026-09-11: other: backported to stable kernel via commit 29f1f9ad9e354cd0b6e4f6fc75ba09162d6a04d9