This vulnerability occurs when the qla2xxx driver copies a firmware‑reported frame size into a fixed‑size 64‑byte buffer without validating the size. If the firmware reports a value larger than 64 bytes, the driver performs a memcpy that writes past the array boundary. The write corrupts adjacent memory in kernel space, which can be leveraged to execute arbitrary code or crash the system. The impact can be escalation of privileges from a local user to root, denial of service, or potential remote compromise if the attacker can control device firmware or messages.

All Linux kernel releases that include the qla2xxx SCSI driver and the qla27xx subnet modules before the patch. The affected vendor is the Linux community and the kernel maintainer for the qla2xxx driver. The patch references commit identifiers that address the buffer overflow. Users of QLogic SCSI devices running an unpatched kernel are affected.

The CVSS score of 7.0 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, but the absence of a KEV list does not guarantee that no exploits exist. The overflow occurs in kernel mode, so exploitation requires a local attacker who can communicate with the QLogic device or send malformed firmware data. With this boundary check missing, an attacker can craft a payload that triggers the overflow, potentially leading to arbitrary kernel code execution or system crash. Given the kernel’s privileged context, the impact is severe if successfully exploited.