The vulnerability exists in the Linux kernel’s qla2xxx SCSI driver. A virtual port index is used to set a bit in a 128‑byte bitmap without verifying that the index remains within bounds. This flaw allows an out‑of‑bounds write that may corrupt adjacent memory inside the IOCB structure. An attacker who can provide a large virtual port index can overwrite control data and potentially execute arbitrary code at ring 0.

Any Linux kernel that includes the qla2xxx driver is vulnerable. The driver contains the qla24xx and qla24xx_ext code paths that can be triggered with an oversized virtual port index. No specific kernel version range is listed; any kernel that still contains the vulnerable code is considered at risk.

The flaw has a CVSS score of 5.5 and an EPSS score below 1%, and it is not listed in the CISA KEV catalog. The likely attack vector is local or through SCSI traffic that targets the qla2xxx driver, where an attacker can send a command that supplies an invalid virtual port index exceeding 128. Successful exploitation would produce a memory corruption that could lead to privilege escalation or complete system compromise. The moderate CVSS and low EPSS suggest that, while possible, exploitation is not widely automated, yet any system that exposes the driver to untrusted input should treat the risk as significant.