Linux kernel qla2xxx: unbounded rsp_info_len underflows sense length and leaks adjacent kernel memory

Impact

In the FWI2 status path, rsp_info_len comes straight from the target's FCP response while par_sense_len is the fixed IOCB data area (28 bytes on 24xx, 60 on 29xx). A target reporting a larger rsp_info_len underflows the unsigned subtraction, pushes the sense-data pointer out of bounds and defeats the cap in qla2x00_handle_sense(), so up to SCSI_SENSE_BUFFERSIZE bytes of adjacent response-ring and heap memory are copied into the command's sense buffer and returned to the initiator. On a GPU node or storage head with QLogic Fibre Channel HBAs, anything that can impersonate or compromise a target on the fabric reads host kernel memory and can crash the node. The fix clamps rsp_info_len before the subtraction.

Who can reach it

From the Fibre Channel fabric: a hostile or malfunctioning FC target the host logs into. No host credentials required; exposure is limited to hosts with qla2xxx HBAs attached to a fabric with untrusted or compromised targets.

What to do

Update to a stable kernel with the linked commits; the driver is in the storage path, so this is a reboot per affected host rather than a module reload in practice - drain the node first. Interim reduction: tighten FC zoning and LUN masking so only trusted targets are reachable. No fixed version numbers are stated in the record.

References

Related entries

• Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slabCVE-2026-90011 · Linux kernel iSCSI target (login payload buffer, MAX_KEY_VALUE_PAIRS)Critical
• Linux kernel nvmet: unvalidated transfer length and halen/dhlen cause heap out-of-bounds read in CHAP negotiateCVE-2026-90230 · Linux kernel nvmet (NVMe-oF target DH-HMAC-CHAP negotiate path)Critical
• Linux kernel IB/isert: login PDU declaring more data than received over-reads the 8KB login bufferCVE-2026-90413 · Linux kernel IB/isert (iSER login PDU DataSegmentLength validation)Critical
• Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to theCVE-2026-90414 · Linux kernel IB/isert (full-feature-phase PDU byte_len validation)Critical
• KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejectedCVE-2026-64106 · Linux kernel KVM arm64 vgic-its (vgic_its_restore_dte num_eventid_bits validation)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh