Executive brief
The Linux kernel's QLA2xxx SCSI driver contains a buffer overflow vulnerability in its I2C device communication handlers. Attackers with raw I/O capabilities can exploit this to corrupt kernel memory and the stack, potentially leading to privilege escalation or system crash. This affects the driver used to manage Fibre Channel storage adapters.
Technical details
The vulnerability exists in the qla2x00_write_i2c() and qla2x00_read_i2c() functions in drivers/scsi/qla2xxx/qla_bsg.c. A 16-bit length field in the qla_i2c_access structure is used without validation to copy data to and from a fixed 64-byte buffer, allowing up to 65535 bytes to be read or written. This causes out-of-bounds access to stack and heap memory. An attacker holding CAP_SYS_RAWIO capability can trigger this via BSG (Block SG) I/O interface requests. The fix adds bounds checks before memcpy and DMA operations, rejecting requests where length exceeds the buffer size.
Affected products
- Linux Linux Kernel multiple versions from 2.6.11 through 6.x (before fix)
Timeline
- 2026-09-16: disclosed
- 2026-07-30: patched: Fix committed upstream; backported to stable branches
- 2026-09-14: other: Patch merged into stable kernels