UBUNTU-CVE-2026-97529: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd[] The FC BSG transport allocates job->request via memdupuser() using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch() only guarantees requestlen covers msgcode and vendorid; it does not account for the vendorcmd[] flexible array. qla2xxx then reads the command selector vendorcmd[0] and, in several sub-handlers, vendorcmd[1]/[2] or structures overlaid on the vendor command area without verifying requestlen. A caller holding CAPSYSRAWIO can submit a short request whose vendorid matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic). Add a central guard in qla2x00processvendorspecific() so the selector is always in bounds, restrict the early vendorcmd[0] read in qla24xxbsgrequest() to sufficiently long vendor messages, and add requestlen checks to the sub-handlers that read further: qla24xxprocfcppriocfgcmd(), qla2x00processloopback(), qla84xxreset(), qla84xxupdatefw(), qla2x00readoptrom(), qla2x00updateoptrom(), qlafx00mgmtcmd() and qla28xxvalidateflashimage().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate FC_BSG_HST_VENDOR request_len before accessing vendor_cmd[]: add a central bounds guard in qla2x00_process_vendor_specific(), require sufficient length before qla24xx_bsg_request() reads vendor_cmd[0], and add request_len checks before further reads in qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(), qla2x00_update_optrom(), qlafx00_mgmt_cmd(), and qla28xx_validate_flash_image().