Linux kernel ibmvfc: a malicious VIO server leaks kernel memory through an unclamped target count

Impact

The ibmvfc driver trusted the num_written field in a discover-targets response from the VIO server and used it as the loop bound over a buffer sized for max_targets entries. A compromised or hostile VIOS returns a larger count, the driver indexes past the DMA-coherent allocation, and the out-of-bounds kernel memory is then packed into Implicit Logout and PLOGI messages sent back to the VIO server - a direct kernel memory disclosure channel, plus the usual crash risk from reading unmapped pages. This only matters to operators whose accelerator nodes are IBM Power LPARs with virtual Fibre Channel, so the blast radius in most GPU fleets is zero; where it applies, the storage path is shared across LPARs and the untrusted party is the virtualization layer the guest cannot audit.

Who can reach it

Adjacent - requires control of the VIO server that serves the LPAR's virtual Fibre Channel adapter. No authentication step beyond that position; an unprivileged user inside the LPAR cannot trigger it.

What to do

Apply the stable kernel update that clamps num_written to max_targets; fixes are in five stable branches. Rollout is a kernel install and an LPAR reboot, so drain the node first. No configuration-level mitigation exists short of not using virtual FC. Nodes on physical FC HBAs or on non-Power hardware are unaffected and need no maintenance window.

References

Related entries

• OpenSSH scp: file fetched as root with -O and without -p can land setuid or setgidCVE-2026-35385 · OpenSSH scp (legacy SCP protocol mode, -O without -p)High
• Linux kernel x86/ftrace: dynamic trampoline mis-relocates per-cpu call-depth accounting, crashing the hostCVE-2026-64235 · Linux kernel x86 ftrace dynamic trampolines (CALL_DEPTH_ACCOUNT %rip-relative relocation)High
• Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user trackingCVE-2026-64368 · Linux kernel SLUB allocator (init-on-alloc zeroing under SLAB_RED_ZONE)High
• Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High
• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High