UBUNTU-CVE-2026-97535: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte (128-bit) array in both vpctrlentry24xx and vpctrlentry24xxext. qla25xxctrlvpiocb() computes map = (vpindex - 1) / 8 and writes vce->vpidxmap[map] without checking that map stays within the array. maxnpivvports is taken from firmware and only sanitized to a MINMULTIIDFABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xxcontrolvp() only rejects vpindex >= maxnpivvports. A vpindex above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vpidxmap, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout). Reject a vpindex that cannot be represented in the IOCB bitmap in qla24xxcontrolvp(), and add a defensive ARRAYSIZE() guard in qla25xxctrlvpiocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to the out-of-bounds write?
Exposure requires a qla2xxx adapter whose firmware reports more than 128 NPIV virtual ports and a virtual-port control operation using an index above 128. Adapters reporting the usual 63 or 127 NPIV vports are unaffected.
What does an attacker or triggering condition need to reach the vulnerable path?
The vulnerable path is reached when qla24xx_control_vp() accepts a virtual-port index that is valid under the firmware-reported maximum but cannot be represented by the IOCB's fixed 128-bit virtual-port bitmap. An index above 128 causes the IOCB construction routine to write beyond that bitmap.
What can be done if the update cannot be applied immediately?
Avoid creating or controlling virtual ports with indices above 128, and limit NPIV virtual-port use to the IOCB bitmap's 128-port capacity. Systems whose adapters report 63 or 127 NPIV vports are not affected by this condition.
Which Ubuntu kernel package variants are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.