CVE-2026-90112

A flaw was found in the qlcnic driver in the Linux kernel. This vulnerability occurs due to insufficient validation of unified ROM sections when processing firmware files. A local attacker could provide a specially crafted or truncated firmware image, leading the driver to read beyond its allocated memory during validation or loading. This out-of-bounds read could result in a denial of service or potentially information disclosure.

A moderate out-of-bounds read flaw was found in the qlcnic network driver in the Linux kernel as shipped in Red Hat Enterprise Linux 7. The driver's unified ROM firmware parser did not adequately validate the directory, product, and data-descriptor fields read from firmware files: table and data end offsets were computed with unchecked additions and multiplications that could wrap before being compared with the firmware size, and typed pointers were dereferenced at firmware-controlled offsets. The loader also read a fixed-size bootloader regardless of its declared size and assumed a fixed-length version tail, so a truncated image could make the driver read past the end of the firmware allocation. A local attacker with the privileges needed to supply a specially crafted or truncated qlcnic firmware image could therefore cause the driver to read beyond the allocated firmware buffer during validation or loading, resulting in a denial of service (kernel panic) or, potentially, the disclosure of limited kernel memory information.

Of Red Hat's current products, only the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 are affected. The fix is deferred for RHEL 7 because that release is in the Extended Life-cycle Support (ELS) phase, during which only Critical severity security flaws are eligible to be addressed, and this flaw is rated moderate. The residual risk is limited to a local denial of service or limited information disclosure by an attacker who can already load a malformed firmware image on a system using QLogic qlcnic network hardware. Red Hat Enterprise Linux 6, 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift releases are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.