CVE-2026-97535

A flaw was found in the Linux kernel's qla2xxx driver. A local user can cause a Denial of Service (DoS) via a system crash by triggering an out-of-bounds memory write during virtual port management. This issue occurs because the driver fails to validate virtual port index numbers against the fixed capacity of the internal command bitmap. As a result, processing an index that exceeds the bitmap boundary corrupts adjacent kernel memory.

A flaw was found in the Linux kernel's qla2xxx Fibre Channel driver, which Red Hat rated as having moderate security impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). When preparing a virtual port control command, qla25xx_ctrlvp_iocb() computes a byte index into the fixed 16-byte (128-bit) vp_idx_map bitmap of the VP control IOCB without verifying that it stays within the array. On qla2xxx adapters whose firmware reports more than 128 NPIV virtual ports (for example 191 or 255), a local user with privileges to manage Fibre Channel virtual ports can specify a virtual port index above 128, producing an out-of-bounds kernel memory write of up to 16 bytes past the bitmap. This corrupts trailing IOCB fields or an adjacent request-ring slot and can crash the kernel, resulting in a denial of service. The flaw is not exploitable remotely over the network because the vulnerable control path is reached only through local virtual port management, and adapters reporting the usual 63 or 127 NPIV virtual ports are not affected. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7 through 10, Red Hat In-Vehicle OS, and the RHEL CoreOS layers of affected OpenShift Container Platform releases are recorded as affected, while Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support and will not receive a fix. The fix is currently deferred for the affected streams; because exploitation requires local privileged access together with an adapter and firmware combination that reports more than 128 NPIV virtual ports, the residual risk is limited to local denial of service on systems in that configuration until a fix is delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.