CVE-2026-97529
Received Received - Intake

Heap Buffer Overflow in Linux Kernel FC BSG Transport

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] The FC BSG transport allocates job->request via memdup_user() using the exact user-supplied request_len. For FC_BSG_HST_VENDOR, fc_bsg_host_dispatch() only guarantees request_len covers msgcode and vendor_id; it does not account for the vendor_cmd[] flexible array. qla2xxx then reads the command selector vendor_cmd[0] and, in several sub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor command area without verifying request_len. A caller holding CAP_SYS_RAWIO can submit a short request whose vendor_id matches the host, triggering out-of-bounds heap reads (KASAN-detectable, and able to mis-select a command or panic). Add a central guard in qla2x00_process_vendor_specific() so the selector is always in bounds, restrict the early vendor_cmd[0] read in qla24xx_bsg_request() to sufficiently long vendor messages, and add request_len checks to the sub-handlers that read further: qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(), qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(), qla2x00_update_optrom(), qlafx00_mgmt_cmd() and qla28xx_validate_flash_image().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97529
EUVD
EUVD-2026-86837

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of BSG request lengths in the qla2xxx SCSI driver. A user with CAP_SYS_RAWIO privileges can submit a short request that triggers out-of-bounds heap reads when the vendor_id matches the host. This occurs because the FC BSG transport allocates memory based on user-supplied request_len but does not verify it covers the entire vendor command area.

Detection Guidance

This vulnerability is specific to the Linux kernel's qla2xxx SCSI driver and requires kernel-level access to detect. Check kernel logs for KASAN (Kernel Address Sanitizer) warnings related to out-of-bounds reads in the qla2xxx module. Look for messages indicating heap corruption or invalid memory access in the SCSI or FC BSG layers.

Impact Analysis

An attacker with CAP_SYS_RAWIO privileges could exploit this to cause a kernel panic or misselect commands, potentially leading to system instability or unauthorized access. The vulnerability is detectable via KASAN but could still cause denial-of-service conditions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97529. Restrict CAP_SYS_RAWIO capabilities to untrusted users to limit exposure. Monitor kernel logs for suspicious activity in the qla2xxx driver or FC BSG transport.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97529. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart