UBUNTU-CVE-2026-98386: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memsetio() to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory (ha->iobase + reqqueoff), not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through memcpytoio() and the wrtreg helpers. qla2x00allociocbs() however zeroed the producer slot with a plain memset(). On architectures such as ARM64 a regular memset() may emit unaligned or block-zeroing instructions (e.g. DC ZVA) that are invalid on Device memory, leading to a synchronous external abort. Use memsetio() to clear the slot for QLAFX00, matching the I/O accessors used elsewhere on this ring. Other adapters keep the plain memset() on their DMA-coherent rings. The zero-fill is retained for FX00 because its IOCB builders (e.g. qlafx00fxdisciocb()) copy only part of the entry and rely on the unused tail being pre-zeroed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Use memset_io() instead of plain memset() to clear the QLAFX00 request ring producer slot, because the ring is ioremapped device I/O memory.
QLAFX00 request ring request ring slot zeroing method = memset_io()
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using a QLAFX00 adapter are affected because its request ring is mapped as device I/O memory. The failure is specifically described for architectures such as ARM64, where ordinary memset() can use instructions that are invalid for Device memory.
What conditions are needed to trigger the failure?
The QLAFX00 driver must allocate IOCBs and clear a request-ring producer slot using the vulnerable code path. A regular local user or remote attacker is not described as the trigger; the supplied vector indicates local attack vector and low privileges, but the description does not provide an exploitation scenario.
What is the expected impact if it occurs?
An invalid memory-clearing instruction on the device-mapped request ring can cause a synchronous external abort. The provided impact vector indicates availability impact only, with high availability impact and no stated confidentiality or integrity impact.
Is every qla2xxx adapter affected?
No. The issue is specific to QLAFX00, whose request ring is ioremapped device I/O memory. Other adapters use DMA-coherent request rings and retain the ordinary memset() behavior.