CVE-2026-97529: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd[]
The FC BSG transport allocates job->request via memdupuser() using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch() only guarantees requestlen covers msgcode and vendorid; it does not account for the vendorcmd[] flexible array.
qla2xxx then reads the command selector vendorcmd[0] and, in several sub-handlers, vendorcmd[1]/[2] or structures overlaid on the vendor command area without verifying requestlen. A caller holding CAPSYSRAWIO can submit a short request whose vendorid matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic).
Add a central guard in qla2x00processvendorspecific() so the selector is always in bounds, restrict the early vendorcmd[0] read in qla24xxbsgrequest() to sufficiently long vendor messages, and add requestlen checks to the sub-handlers that read further: qla24xxprocfcppriocfgcmd(), qla2x00processloopback(), qla84xxreset(), qla84xxupdatefw(), qla2x00readoptrom(), qla2x00updateoptrom(), qlafx00mgmtcmd() and qla28xxvalidateflashimage().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate FC_BSG_HST_VENDOR request_len before accessing vendor_cmd[]: add a central bounds guard in qla2x00_process_vendor_specific(), restrict the early vendor_cmd[0] read in qla24xx_bsg_request() to sufficiently long vendor messages, and add request_len checks before further reads in qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(), qla2x00_update_optrom(), qlafx00_mgmt_cmd(), and qla28xx_validate_flash_image().
Event History
Frequently Asked Questions
Who can trigger the out-of-bounds reads?
An attacker needs CAP_SYS_RAWIO and access to submit FC BSG host-vendor requests to a qla2xxx Fibre Channel host. The request must use a vendor_id matching the host and a deliberately short request_len.
What can happen if a vulnerable driver processes a short request?
The driver can read beyond the heap buffer allocated for the user request. This can cause a KASAN-detectable out-of-bounds read, select an unintended command, or panic the kernel.
Which request fields were insufficiently validated?
The FC BSG transport ensures only that request_len covers msgcode and vendor_id for FC_BSG_HST_VENDOR requests. qla2xxx needed additional validation before reading vendor_cmd[0], later vendor_cmd elements, or command structures overlaid on the vendor command area.