CVE-2026-97529: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd[]
The FC BSG transport allocates job->request via memdupuser() using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch() only guarantees requestlen covers msgcode and vendorid; it does not account for the vendorcmd[] flexible array.
qla2xxx then reads the command selector vendorcmd[0] and, in several sub-handlers, vendorcmd[1]/[2] or structures overlaid on the vendor command area without verifying requestlen. A caller holding CAPSYSRAWIO can submit a short request whose vendorid matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic).
Add a central guard in qla2x00processvendorspecific() so the selector is always in bounds, restrict the early vendorcmd[0] read in qla24xxbsgrequest() to sufficiently long vendor messages, and add requestlen checks to the sub-handlers that read further: qla24xxprocfcppriocfgcmd(), qla2x00processloopback(), qla84xxreset(), qla84xxupdatefw(), qla2x00readoptrom(), qla2x00updateoptrom(), qlafx00mgmtcmd() and qla28xxvalidateflashimage().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate the user-supplied request_len before reading vendor_cmd[]: add a central guard in qla2x00_process_vendor_specific() requiring CAP_SYS_RAWIO callers to provide a sufficiently long request whose vendor_id matches FC_BSG_HST_VENDOR; restrict the early vendor_cmd[0] read in qla24xx_bsg_request() to sufficiently long vendor messages; and add request_len checks before reading vendor_cmd[1]/[2] or overlaid structures in qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla28xx_validate_flash_image(), qla2x00_update_optrom(), qlafx00_mgmt_cmd(), qla84xx_reset(), qla84xx_updatefw(), and qla2x00_read_optrom().