CVE-2026-98155: accel/qaic: Address potential out-of-bounds read in resp_worker()
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Address potential out-of-bounds read in respworker()
Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAICTRANSDEACTIVATEFROMDEV, if present, it skipped over the bounds checking code that is included in decodemessage(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device.
Instead of duplicating the bounds checking code already present in decodemessage(), use the function inside respworker().
Affected Software
Event History
Frequently Asked Questions
What is required to trigger the issue?
The device must send a malformed wire message to the kernel's QAIC response worker. The reported failure modes include reading past the end of a slab allocation, infinite loops, and kernel panics.