CVE-2026-23059: scsi: qla2xxx: Sanitize payload size to prevent member overflow
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Sanitize payload size to prevent member overflow
In qla27xxcopyfpinpkt() and qla27xxcopymultiplepkt(), the framesize reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purexitem.
If the reported framesize exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIGFORTIFYSOURCE.
Fix this by capping totalbytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), cap total_bytes/frame_size to 64 bytes—the size of item->iocb—before allocation and copying, ensuring all memcpy operations remain within the destination structure member.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23059?
CVE-2026-23059 is classified as a high severity vulnerability due to its potential impact on system stability and security.
How do I fix CVE-2026-23059?
To fix CVE-2026-23059, update your Linux kernel to the latest version where this vulnerability has been addressed.
What are the risks associated with CVE-2026-23059?
The risks associated with CVE-2026-23059 include potential memory corruption and exploitation leading to denial of service.
Which versions of Linux Kernel are affected by CVE-2026-23059?
CVE-2026-23059 affects multiple versions of the Linux Kernel prior to the patch release that resolves this vulnerability.
Is CVE-2026-23059 a network vulnerability?
Yes, CVE-2026-23059 can be exploited over the network by attackers due to its impact on SCSI command processing.