The Linux kernel’s QLA2xxx SCSI driver does not verify the length of a user‑supplied SCSI generic (SG) request before accessing elements of the vendor_cmd flexible array. An attacker with CAP_SYS_RAWIO can craft a short request that satisfies the initial checks yet triggers out-of-bounds heap reads. The driver may read vendor_cmd[1] or [2] or larger structures without bounds validation, causing KASAN‑detectable memory corruption, kernel panic, or the ability to mis‑select a command. The weakness is a classic input‑validation error (CWE-125).

All Linux kernel releases that include the QLA2xxx driver (qla24xx, qla28xx, qla84xx families) before the patch that adds request_len checks in qla2x00_process_vendor_specific() and related handlers. The specific kernel version is not enumerated; any build prior to the commit that implements these checks is vulnerable.

The exploit requires local, privileged access (CAP_SYS_RAWIO) to send crafted SG vendor commands, making the attack vector effectively local. The CVSS score of 5.5 reflects moderate severity, while the EPSS of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. If exploited, the attacker can cause kernel out-of-bounds reads and potentially a crash or privilege escalation if they can influence the vendor command data.