CVE-2026-97529 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
The FC BSG transport allocates job->request via memdup_user() using the exact user-supplied request_len. For FC_BSG_HST_VENDOR, fc_bsg_host_dispatch() only guarantees request_len covers msgcode and vendor_id; it does not account for the vendor_cmd[] flexible array.
qla2xxx then reads the command selector vendor_cmd[0] and, in several
sub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor
command area without verifying request_len. A caller holding CAP_SYS_RAWIO can submit a short request whose vendor_id matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic).
Add a central guard in qla2x00_process_vendor_specific() so the selector is always in bounds, restrict the early vendor_cmd[0] read in
qla24xx_bsg_request() to sufficiently long vendor messages, and add request_len checks to the sub-handlers that read further: qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(), qla2x00_update_optrom(), qlafx00_mgmt_cmd() and qla28xx_validate_flash_image().
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's SCSI subsystem, specifically the QLogic FC BSG transport layer in the qla2xxx driver, contains a critical input validation flaw that allows for out-of-bounds heap reads. This vulnerability arises from an inconsistency between how memory is allocated and how it is accessed during vendor-specific command processing. When handling FC_BSG_HST_VENDOR requests, the kernel allocates a buffer using memdup_user based on the user-supplied request_len field. However, the dispatch logic only ensures that this length covers basic fields like msgcode and vendor_id, neglecting to account for the variable-length vendor_cmd array embedded within the structure. Consequently, subsequent driver handlers proceed to read from vendor_cmd indices without verifying whether those offsets fall within the bounds of the allocated buffer.
This lack of boundary checking creates a significant security risk for processes with CAP_SYS_RAWIO privileges. An attacker can craft a malicious request where the specified length is shorter than the data actually accessed by the driver's sub-handlers. By submitting such a short request that matches the expected vendor_id, an adversary can trigger out-of-bounds reads on the kernel heap. These unauthorized memory accesses are detectable via Kernel Address Sanitizer and can lead to severe operational consequences, including mis-selection of command handlers or system panics due to invalid data retrieval. The vulnerability effectively allows for information disclosure through leaked kernel memory contents and potential denial of service conditions.
The technical root cause is classified under CWE-125, which describes out-of-bounds read vulnerabilities in C/C++ programs where the application reads past the end of a buffer. In the context of attack frameworks, this flaw aligns with ATT&CK technique T1083, File and Directory Discovery, as it enables an attacker to probe kernel memory structures that are not intended for user access. The exploitation path relies on the privilege level required to issue raw I/O commands, typically CAP_SYS_RAWIO, which is often held by container runtimes or privileged system services. This makes the vulnerability particularly dangerous in virtualized environments where such privileges might be granted to untrusted workloads if isolation boundaries are not strictly enforced.
To mitigate this risk, a comprehensive patch has been implemented that introduces strict length validation at multiple points within the qla2xxx driver codebase. A central guard was added to the qla2x00_process_vendor_specific function to ensure command selectors remain in bounds before any access occurs. Furthermore, early reads of vendor_cmd[0] in qla24xx_bsg_request are now restricted to sufficiently long messages that guarantee safety. Additional request_len checks were integrated into specific sub-handlers including qla24xx_proc_fcp_prio_cfg_cmd, qla2x00_process_loopback, qla84xx_reset, qla84xx_updatefw, qla2x00_read_optrom, qla2x00_update_optrom, qlafx00_mgmt_cmd, and qla28xx_validate_flash_image. These changes ensure that all vendor command processing respects the actual size of the user-supplied buffer, preventing out-of-bounds access regardless of the content or length provided by the caller. System administrators should apply this kernel update immediately to close these memory safety gaps and prevent potential exploitation through privileged raw I/O interfaces.