CVE-2026-97529

A flaw was found in the Linux kernel's qla2xxx driver. The driver fails to validate the length of vendor-specific request buffers before reading command data, resulting in an out-of-bounds read from heap memory. A local user with administrative privileges can exploit this flaw by submitting a truncated request, leading to a Denial of Service (DoS) through a kernel crash or the disclosure of sensitive kernel memory.

A moderate out-of-bounds read vulnerability exists in the Linux kernel qla2xxx Fibre Channel driver as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS images used by OpenShift Container Platform 4 and 5. The Fibre Channel BSG transport allocates the job request buffer with the exact user-supplied request_len, but for FC_BSG_HST_VENDOR requests the qla2xxx driver reads vendor_cmd[] selector bytes and command-specific structures without verifying that the buffer is long enough to contain them. A local attacker holding the CAP_SYS_RAWIO capability, which is required to submit BSG vendor requests, can send a truncated request with a matching vendor_id to trigger out-of-bounds heap reads, which can cause a kernel panic (denial of service), mis-selection of a vendor command, or disclosure of kernel memory. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream, and the Red Hat Enterprise Linux 6 Extended Lifecycle Support relationship is out of support scope. Red Hat rates the severity of this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local privileged access on systems using supported qla2xxx Fibre Channel adapters and the BSG device interface, and the flaw is not network-reachable. Fixes for the affected products are deferred because exploitation requires high local privileges and poses limited practical risk; the residual risk is denial of service or kernel memory disclosure by a locally privileged user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.