Linux kernel qla2xxx: unbounded rsp_info_len underflows sense length and leaks adjacent kernel memory

Impact

In the FWI2 status path, rsp_info_len comes straight from the target's FCP response while par_sense_len is the fixed IOCB data area (28 bytes on 24xx, 60 on 29xx). A target reporting a larger rsp_info_len underflows the unsigned subtraction, pushes the sense-data pointer out of bounds and defeats the cap in qla2x00_handle_sense(), so up to SCSI_SENSE_BUFFERSIZE bytes of adjacent response-ring and heap memory are copied into the command's sense buffer and returned to the initiator. On a GPU node or storage head with QLogic Fibre Channel HBAs, anything that can impersonate or compromise a target on the fabric reads host kernel memory and can crash the node. The fix clamps rsp_info_len before the subtraction.

Who can reach it

From the Fibre Channel fabric: a hostile or malfunctioning FC target the host logs into. No host credentials required; exposure is limited to hosts with qla2xxx HBAs attached to a fabric with untrusted or compromised targets.

What to do

Update to a stable kernel with the linked commits; the driver is in the storage path, so this is a reboot per affected host rather than a module reload in practice - drain the node first. Interim reduction: tighten FC zoning and LUN masking so only trusted targets are reachable. No fixed version numbers are stated in the record.

References

Related entries

• Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slabCVE-2026-90011 · Linux kernel iSCSI target (login payload buffer, MAX_KEY_VALUE_PAIRS)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High