CVE-2026-89846: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read
In qla2x00statusentry(), the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen:
if (ISFWI2CAPABLE(ha)) { sensedata += rspinfolen; parsenselen -= rspinfolen; }
rspinfolen is a 32-bit value taken directly from the target's FCP response (sf.rspdatalen), while parsenselen is the IOCB data area size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rspinfolen larger than parsenselen makes the unsigned subtraction underflow to a huge value and advances sensedata out of bounds.
The underflowed parsenselen then defeats the cap in qla2x00handlesense():
if (senselen > parsenselen) senselen = parsenselen; memcpy(cp->sensebuffer, sensedata, senselen);
so the memcpy reads up to SCSISENSEBUFFERSIZE bytes from the out-of-bounds sensedata pointer, leaking adjacent response-ring/heap memory into the command's sense buffer.
Clamp rspinfolen to parsenselen before the subtraction so parsenselen can never underflow and sensedata stays within the IOCB data area. The fix sits before the compstatus switch, covering both qla2x00handlesense() call sites.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux qla2xxx SCSI driver on FWI2-capable adapters are affected when they process FCP responses from a target. The vulnerable path uses an IOCB data area of 28 bytes on 24xx hardware and 60 bytes on 29xx hardware.
What does an attacker or faulty device need to do to trigger it?
A target must return an FCP response whose rsp_data_len value is larger than the available IOCB parameter sense-data length. This causes an unsigned length underflow and moves the sense-data pointer outside the IOCB data area.
What is the practical impact?
The driver can copy up to SCSI_SENSE_BUFFERSIZE bytes from an out-of-bounds pointer into the command sense buffer. This can disclose adjacent response-ring or heap memory through the sense-data handling path.
What mitigation is available if the fix cannot be deployed immediately?
The provided data identifies hostile or buggy storage targets as the trigger source. Limiting connections to trusted targets can reduce exposure, but no configuration-based mitigation is specified.