CVE-2026-97535: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size
The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte (128-bit) array in both vpctrlentry24xx and vpctrlentry24xxext. qla25xxctrlvpiocb() computes map = (vpindex - 1) / 8 and writes vce->vpidxmap[map] without checking that map stays within the array.
maxnpivvports is taken from firmware and only sanitized to a MINMULTIIDFABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xxcontrolvp() only rejects vpindex >= maxnpivvports. A vpindex above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vpidxmap, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout).
Reject a vpindex that cannot be represented in the IOCB bitmap in qla24xxcontrolvp(), and add a defensive ARRAYSIZE() guard in qla25xxctrlvpiocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In qla24xx_control_vp(), reject any vp_index that cannot be represented in the VP_CTRL IOCB bitmap, and in qla25xx_ctrlvp_iocb() add an ARRAY_SIZE() guard before writing to vp_idx_map.
Event History
Frequently Asked Questions
Which systems are affected in practice?
Exposure requires a qla2xxx adapter whose firmware reports enough NPIV virtual ports to permit a virtual-port index above 128. Adapters reporting the usual 63 or 127 NPIV vports are unaffected; firmware values such as 191 or 255 can be affected.
What operation triggers the memory corruption?
The vulnerable path is reached when a VP control IOCB is built for a virtual-port index above 128. That index produces a bitmap offset outside the fixed 16-byte vp_idx_map array, causing an out-of-bounds write into trailing IOCB fields or an adjacent request-ring slot.
What can be done before updating the kernel?
Avoid creating or controlling NPIV virtual ports with indexes above 128 on adapters that report more than 128 supported NPIV vports. This prevents the index from exceeding the IOCB bitmap's representable range.