The Linux ibmvfc SCSI driver includes an unchecked “num_written” value returned by a VIO server. When this value exceeds the allocated target array size, it is stored in vhost->num_targets and later used as a loop bound during target allocation. Because the buffer is only sized for max_targets entries, the driver indexes beyond the allocation and reads kernel memory located outside the DMA‑coherent buffer. The data read is subsequently piggybacked into Implicit Logout and PLOGI messages sent back to the VIO server, allowing an attacker to obtain arbitrary kernel memory. This out-of-bounds read aligns with CWE‑125 (Out‑of‑bounds Read) and CWE‑1285 (Improper Bound Checking).

All Linux kernel builds that include the ibmvfc driver before the fix are affected. No specific version range is supplied, so any kernel with the vulnerable code prior to the commit that clamps “num_written” to “max_targets” is susceptible. Updating to a kernel version that incorporates the relevant commit resolves the issue.

An attacker who can control or compromise a VIO server can send a crafted discovery targets MAD to a Linux host. No local privileges are required; the exploit relies solely on network communication with the SCSI driver. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The CVSS score of 8.1 classifies the flaw as high severity. The risk still hinges on the presence of untrusted VIO traffic within the trusted network segment of the host.