CVE-2026-98386

Received Received - Intake

Memory Corruption in Linux Kernel QLA2XXX Driver

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory (ha->iobase + req_que_off), not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through memcpy_toio() and the wrt_reg_* helpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a plain memset(). On architectures such as ARM64 a regular memset() may emit unaligned or block-zeroing instructions (e.g. DC ZVA) that are invalid on Device memory, leading to a synchronous external abort. Use memset_io() to clear the slot for QLAFX00, matching the I/O accessors used elsewhere on this ring. Other adapters keep the plain memset() on their DMA-coherent rings. The zero-fill is retained for FX00 because its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of the entry and rely on the unused tail being pre-zeroed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98386

EUVD

EUVD-2026-101035

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8ae6d9c7eb1004bc134813287010d57a863ba13b
Linux	Linux	8ae6d9c7eb1004bc134813287010d57a863ba13b
Linux	Linux	8ae6d9c7eb1004bc134813287010d57a863ba13b
Linux	Linux	8ae6d9c7eb1004bc134813287010d57a863ba13b
Linux	Linux	3.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's SCSI driver for QLogic QLA2xxx adapters. It involves a bug where the producer slot of the QLAFX00 request ring was cleared using a regular memset() instead of memset_io(). On ARM64 systems, this can cause issues because memset() may use instructions that are invalid for device memory, leading to a system crash.

Detection Guidance

This vulnerability affects the Linux kernel's qla2xxx SCSI driver, specifically when handling QLAFX00 request ring slots. Detection requires checking if your system uses the affected kernel version and qla2xxx driver. Inspect kernel logs for errors related to qla2xxx or memory access violations. Check driver version with commands like 'modinfo qla2xxx' or 'dmesg | grep qla2xxx'. If you see synchronous external abort errors in logs, it may indicate exploitation.

Impact Analysis

If you use a system with a QLogic QLA2xxx adapter and an ARM64 processor, this vulnerability could cause a system crash or instability when the adapter processes I/O requests. This may lead to data corruption or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level memory access issue in the Linux kernel's SCSI driver. It may indirectly impact compliance if systems relying on this driver fail due to crashes or data corruption, potentially affecting data integrity or availability requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98386. This vulnerability affects the qla2xxx SCSI driver and requires a kernel update to resolve the issue with memset_io() usage on QLAFX00 request rings.

Hi! I’m here to help you understand CVE-2026-98386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70