Executive brief
The Qlogic qlcnic Ethernet driver in the Linux kernel contains an out-of-bounds read vulnerability when parsing firmware files during driver initialization. A malformed or truncated firmware image can cause the driver to read beyond allocated memory buffers, potentially leading to information disclosure or system crashes affecting network connectivity on servers using Qlogic CNA network adapters.
Technical details
The vulnerability exists in the unified ROM firmware parser (drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c) which reads and validates firmware image metadata. The root cause involves multiple validation gaps: unchecked arithmetic operations (additions and multiplications) can cause integer wrapping when computing table boundaries, firmware-controlled offsets allow dereferencing pointers into attacker-controlled data, and consumers make unsafe assumptions about fixed field sizes (17-byte version tail, fixed bootloader length, u64 final words) without verifying sufficient data remains. The parser is reachable during driver probe/initialization when loading firmware from the filesystem, requiring no special privileges but local code execution capability. The fix adds bounded range validation helpers, pre-validates all arithmetic before comparisons, uses unaligned little-endian accessors for safe field reading, and assembles partial final words only from bytes that exist. The patch has been merged into mainline and stable kernel branches.
Affected products
- Linux Linux Kernel kernel versions before the fix commit (2026-08-16); affects multiple stable branches including 4.x through 7.x series
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-08-16: patched: Fix committed by Pengpeng Hou (commit 5e8076e4e4124dae75a3e080ddc20404700d7585)
- 2026-09-14: patched: Backported to stable kernels (commit 4be733a450c86938c91f9c70a56802ef5069764c)