CVE-2026-97529: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd[]

The FC BSG transport allocates job->request via memdupuser() using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch() only guarantees requestlen covers msgcode and vendorid; it does not account for the vendorcmd[] flexible array.

qla2xxx then reads the command selector vendorcmd[0] and, in several sub-handlers, vendorcmd[1]/[2] or structures overlaid on the vendor command area without verifying requestlen. A caller holding CAPSYSRAWIO can submit a short request whose vendorid matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic).

Add a central guard in qla2x00processvendorspecific() so the selector is always in bounds, restrict the early vendorcmd[0] read in qla24xxbsgrequest() to sufficiently long vendor messages, and add requestlen checks to the sub-handlers that read further: qla24xxprocfcppriocfgcmd(), qla2x00processloopback(), qla84xxreset(), qla84xxupdatefw(), qla2x00readoptrom(), qla2x00updateoptrom(), qlafx00mgmtcmd() and qla28xxvalidateflashimage().

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Validate the user-supplied request_len before reading vendor_cmd[]: add a central guard in qla2x00_process_vendor_specific() requiring CAP_SYS_RAWIO callers to provide a sufficiently long request whose vendor_id matches FC_BSG_HST_VENDOR; restrict the early vendor_cmd[0] read in qla24xx_bsg_request() to sufficiently long vendor messages; and add request_len checks before reading vendor_cmd[1]/[2] or overlaid structures in qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla28xx_validate_flash_image(), qla2x00_update_optrom(), qlafx00_mgmt_cmd(), qla84xx_reset(), qla84xx_updatefw(), and qla2x00_read_optrom().

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
Description

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203