CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
In the Linux kernel, the following vulnerability has been resolved:
scsi: ibmvfc: Fix OOB access in ibmvfcdiscovertargetsdone()
A malicious or compromised VIO server can return a numwritten value in the discover targets MAD response that exceeds maxtargets. This value is stored directly in vhost->numtargets without validation, and is then used as the loop bound in ibmvfcalloctargets() to index into discbuf[], which is only allocated for maxtargets entries. Indices at or beyond maxtargets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory.
Fix by clamping numwritten to maxtargets before storing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Clamp the num_written value to max_targets before storing it, preventing ibmvfc_discover_targets_done() from using an out-of-bounds loop bound.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux ibmvfc SCSI driver and communicating with a VIO server are exposed. The vulnerable path processes Discover Targets MAD responses received from that server.
What does exploitation require?
A malicious or compromised VIO server must return a Discover Targets response with a num_written value greater than max_targets. No local privileges or user interaction are indicated by the supplied severity vector.
What is the impact of a successful exploit?
The oversized value causes indexing beyond the allocated disc_buf[] entries. Data from outside that DMA-coherent allocation can be included in Implicit Logout and PLOGI MADs sent to the VIO server, leaking kernel memory.
What is the remediation?
Apply a kernel update containing the fix that clamps num_written to max_targets before it is stored and used as a loop bound. This prevents accesses beyond the buffer allocated for target discovery.