CVE-2026-97535

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

The VP control IOCB selects its target virtual port by setting one bit

in vp_idx_map, a fixed 16-byte (128-bit) array in both

vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()

computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map]

without checking that map stays within the array.

max_npiv_vports is taken from firmware and only sanitized to a

MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or

255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports.

A vp_index above 128 therefore yields map >= 16 and an out-of-bounds

write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB

fields (or the adjacent request-ring slot on the 64-byte layout).

Reject a vp_index that cannot be represented in the IOCB bitmap in

qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in

qla25xx_ctrl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References