Executive brief
The qla2xxx driver for QLogic SCSI HBAs contains a flaw in how FRU and I2C management handlers initialize bounce buffers used for device communication. Uninitialized heap memory is inadvertently written to device flash storage when the transfer length is manipulated, potentially exposing sensitive kernel memory contents to an attacker with local access to perform I/O operations.
Technical details
The vulnerability is an information disclosure in the qla2xxx SCSI driver's FRU (Field Replaceable Unit) and I2C BSG (Block SG) handlers. The handlers allocate 256-byte DMA bounce buffers using dma_pool_alloc() without zeroing, then initialize only a small prefix (e.g., 36 bytes for FRU version) before passing to qla2x00_write_sfp(). An attacker can manipulate the transfer length via user-supplied payload bytes: the first byte of the payload (*sfp) can be used to override len to grow up to 255 bytes. This causes the hardware to DMA-read uninitialized heap memory beyond the written region and write it to device flash. The fix changes all five FRU/I2C handlers from dma_pool_alloc() to dma_pool_zalloc(), ensuring uninitialized bytes are zeroed. No authentication is required; an attacker with local access to send BSG commands can trigger this.
Affected products
- Linux Linux kernel All versions with qla2xxx driver containing the vulnerable FRU/I2C handlers
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Commit b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc merged into stable trees