CVE-2026-97529

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

The FC BSG transport allocates job->request via memdup_user() using the

exact user-supplied request_len. For FC_BSG_HST_VENDOR,

fc_bsg_host_dispatch() only guarantees request_len covers msgcode and

vendor_id; it does not account for the vendor_cmd[] flexible array.

qla2xxx then reads the command selector vendor_cmd[0] and, in several

sub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor

command area without verifying request_len. A caller holding

CAP_SYS_RAWIO can submit a short request whose vendor_id matches the

host, triggering out-of-bounds heap reads (KASAN-detectable, and able to

mis-select a command or panic).

Add a central guard in qla2x00_process_vendor_specific() so the selector

is always in bounds, restrict the early vendor_cmd[0] read in

qla24xx_bsg_request() to sufficiently long vendor messages, and add

request_len check

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References