CVE-2026-97535 - Vulnerability Details

- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

The VP control IOCB selects its target virtual port by setting one bit
in vp_idx_map, a fixed 16-byte (128-bit) array in both
vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()
computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map]
without checking that map stays within the array.

max_npiv_vports is taken from firmware and only sanitized to a
MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or
255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports.
A vp_index above 128 therefore yields map >= 16 and an out-of-bounds
write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB
fields (or the adjacent request-ring slot on the 64-byte layout).

Reject a vp_index that cannot be represented in the IOCB bitmap in
qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in
qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual
63 or 127 NPIV vports are unaffected.

Published: 2026-09-25

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises in the Linux SCSI qla2xxx driver when a virtual port index is used to set a bit in a 128‑byte bitmap without verifying the index is within bounds. An out‑of‑bounds write of up to 16 bytes can corrupt adjacent memory within the IOCB structure, potentially allowing an attacker to overwrite control data and achieve arbitrary code execution at ring 0.

Affected Systems

The flaw affects any Linux kernel that includes the qla2xxx driver for QLogic SCSI controllers. The vulnerability is tied to the qla24xx and qla24xx_ext driver code paths. No explicit kernel version range is given, so any kernel version containing the vulnerable code is potentially impacted.

Risk and Exploitability

The CVSS score and EPSS information are not available, and the flaw is not listed in the CISA KEV catalog. Given that the bug involves a kernel out‑of‑bounds write, the risk can be considered high for systems that expose the qla2xxx driver to untrusted SCSI traffic. The likely attack vector is local interaction with the SCSI subsystem or via vendor firmware that can supply an oversized virtual port index. An exploiter would need to trigger the vulnerable code path, which could lead to privilege escalation or complete system compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2853192e154b813fe34a6cbee5e34dfef50d29d0`	affected	< 48a44e19746eaa70320a3c2571dcb345192fca72
`2853192e154b813fe34a6cbee5e34dfef50d29d0`	affected	< 13354ad251ab009102597a791bc7c4d2265229e1
`2853192e154b813fe34a6cbee5e34dfef50d29d0`	affected	< 878613ecb5a36db26859c4fd83daf9283a334fa2

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2853192e154b813fe34a6cbee5e34dfef50d29d0,48a44e19746eaa70320a3c2571dcb345192fca72)`	affected	code_commit	—
`[2853192e154b813fe34a6cbee5e34dfef50d29d0,13354ad251ab009102597a791bc7c4d2265229e1)`	affected	code_commit	—
`[2853192e154b813fe34a6cbee5e34dfef50d29d0,878613ecb5a36db26859c4fd83daf9283a334fa2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the upstream patch that adds bounds checking and guards the bitmap write in the qla2xxx driver
If an immediate patch is not feasible, disable or unload the qla2xxx driver and avoid use of large virtual port counts
Update the SCSI host adapter firmware to limit max_npiv_vports to 128 or less, preventing index values that exceed the bitmap size

Generated by OpenCVE AI on September 25, 2026 at 12:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/13354ad251ab009102597a791bc7c4d2265229e1
https://git.kernel.org/stable/c/48a44e19746eaa70320a3c2571dcb345192fca72
https://git.kernel.org/stable/c/878613ecb5a36db26859c4fd83daf9283a334fa2

History

Fri, 25 Sep 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vp_idx_map, a fixed 16-byte (128-bit) array in both vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb() computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map] without checking that map stays within the array. max_npiv_vports is taken from firmware and only sanitized to a MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports. A vp_index above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout). Reject a vp_index that cannot be represented in the IOCB bitmap in qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected.
Title		scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/13354ad251ab009102597a791bc7c4d2265229e1 https://git.kernel.org/stable/c/48a44e19746eaa70320a3c2571dcb345192fca72 https://git.kernel.org/stable/c/878613ecb5a36db26859c4fd83daf9283a334fa2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:21:34.395Z

Updated: 2026-09-25T10:21:34.395Z

Reserved: 2026-09-24T16:01:01.153Z

Link: CVE-2026-97535

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:03.757

Modified: 2026-09-25T11:17:03.757

Link: CVE-2026-97535

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T15:15:14Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object