All vulnerabilities
CVE-2026-97535

Linux: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in674d783f2e80d0d7c1c86bf36dc0a09033e704deAlso 48a44e19746eaa70320a3c2571dcb345192fca72, 13354ad251ab009102597a791bc7c4d2265229e1 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 674d783f2e80d0d7c1c86bf36dc0a09033e704deLinuxCVE List
  • 48a44e19746eaa70320a3c2571dcb345192fca72LinuxCVE List
  • 13354ad251ab009102597a791bc7c4d2265229e1LinuxCVE List
  • 878613ecb5a36db26859c4fd83daf9283a334fa2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

The VP control IOCB selects its target virtual port by setting one bit in vp_idx_map, a fixed 16-byte (128-bit) array in both vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb() computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map] without checking that map stays within the array.

max_npiv_vports is taken from firmware and only sanitized to a MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports. A vp_index above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout).

Reject a vp_index that cannot be represented in the IOCB bitmap in qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected.

Text from CVE List

Affected versions 12

  • Linuxaffected: 2853192e154b813fe34a6cbee5e34dfef50d29d0 before 674d783f2e80d0d7c1c86bf36dc0a09033e704deCVE List
  • Linuxaffected: 2853192e154b813fe34a6cbee5e34dfef50d29d0 before c80a0362a0fe548c15a0324b1f61c04b62bb2174CVE List
  • Linuxaffected: 2853192e154b813fe34a6cbee5e34dfef50d29d0 before 48a44e19746eaa70320a3c2571dcb345192fca72CVE List
  • Linuxaffected: 2853192e154b813fe34a6cbee5e34dfef50d29d0 before 13354ad251ab009102597a791bc7c4d2265229e1CVE List
  • Linuxaffected: 2853192e154b813fe34a6cbee5e34dfef50d29d0 before 878613ecb5a36db26859c4fd83daf9283a334fa2CVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5