CVE-2026-23059
Unknown Unknown - Not Provided

Buffer Overflow in Linux qla2xxx Driver Causes Memory Corruption

Publication date: 2026-02-04

Last updated on: 2026-02-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item. If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE. Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-04
Last Modified
2026-02-04
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23059
EUVD
EUVD-2026-5485

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's qla2xxx driver, specifically in the functions qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(). The issue arises because the frame_size reported by firmware is used to determine how much data to copy into a fixed-size 64-byte array called iocb within the purex_item structure.

If the frame_size exceeds 64 bytes, the memcpy operation will overflow the iocb array boundary, potentially writing into adjacent memory. Although extra memory might be allocated, this cross-member write is unsafe and triggers warnings under the CONFIG_FORTIFY_SOURCE security feature.

The vulnerability was fixed by capping the total bytes copied to the size of the iocb member (64 bytes), ensuring that all copies remain within the bounds of the destination structure member.

Impact Analysis

This vulnerability can lead to memory corruption due to buffer overflow when copying data beyond the fixed-size array boundary. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.

Additionally, the unsafe memory writes trigger security warnings under CONFIG_FORTIFY_SOURCE, indicating a potential security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart