CVE-2026-23059

A buffer overflow vulnerability was found in the Linux kernel's QLogic qla2xxx Fibre Channel driver. The qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt() functions use firmware-reported frame_size to calculate copy length into item->iocb, a fixed 64-byte array. When frame_size exceeds 64 bytes, the memcpy operations overflow the iocb member boundary, writing into adjacent structure members.

This flaw affects systems with QLogic Fibre Channel HBAs using the qla2xxx driver. The overflow is triggered by malformed firmware responses containing oversized frame_size values. While CONFIG_FORTIFY_SOURCE detects and warns about the cross-member write, the practical security impact depends on what data overwrites adjacent structure members and whether attackers can control firmware responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the qla2xxx module from being loaded if QLogic Fibre Channel adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.