Executive brief
The qla2xxx SCSI driver in the Linux kernel contains a vulnerability where MSI-X interrupt vector counts are incorrectly truncated when assigned to queue configuration variables. A device advertising an abnormally high number of MSI-X vectors (e.g., 257) could trigger memory corruption or kernel crashes when the driver allocates memory for I/O queues, potentially leading to system instability or denial of service on storage systems relying on this driver.
Technical details
The vulnerability is an integer truncation bug in the qla2xxx SCSI host adapter driver. The variable ha->msix_count is a u16 (16-bit), but the derived variables ha->max_req_queues, ha->max_rsp_queues, and ha->max_qpairs are u8 (8-bit). When msix_count is assigned with values ≥257, the subtraction "msix_count - 1" results in a value (e.g., 256) that truncates to 0 when stored in a u8. This zero value is then passed to kzalloc_objs(), which returns ZERO_SIZE_PTR instead of NULL, bypassing allocation failure checks. The subsequent memory access ha->req_q_map[0] = req dereferences ZERO_SIZE_PTR, causing memory corruption or kernel panic. The fix introduces qla_calc_queue_count() to clamp values into [1, QLA_MAX_QUEUES-1]. Attack vector requires a malicious or misconfigured PCIe device advertising ≥257 MSI-X vectors, a local/adjacent requirement. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions with qla2xxx driver
Timeline
- 2026-09-16: disclosed
- 2026-07-30: patched: Patch authored by Nilesh Javali