EUVD-2026-80456
GHSA-m9fj-xvr8-vh59
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trigger is a malicious/misconfigured hot-plugged HBA advertising a boundary MSI-X count, so AV:P/AC:H; ZERO_SIZE_PTR deref is crash/corruption-dominant (A:H, I:L) with no confidentiality leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and ha->max_qpairs are u8. Deriving the queue count as "ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board (or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X count of 1 zeroes it as well, and in target mode the subsequent "ha->max_req_queues--" then underflows 0 to 255.
When the count is 0, qla2x00_alloc_queues() calls kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is not NULL, so the allocation check passes and the following "ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory or crashing the kernel.
Add qla_calc_queue_count() to clamp the derived value into [1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and use it at all three derivation sites (qla25xx_iospace_config(), qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the target-mode decrement so it cannot reintroduce a zero (which would in turn underflow max_qpairs).
AnalysisAI
Memory corruption and kernel crashes in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arise from an integer truncation when the driver derives its request/response queue counts from the adapter's advertised MSI-X vector count. Affected systems are those running the CONFIG_SCSI_QLA_FC driver and bound to a QLogic FC HBA that reports a boundary MSI-X count (257 vectors, which truncates to zero in the u8 queue-count fields, or exactly 1), after which qla2x00_alloc_queues() obtains ZERO_SIZE_PTR from kzalloc_objs(struct req_que *, 0) and then dereferences it via ha->req_q_map[0]; target-mode configurations can additionally underflow max_req_queues from 0 to 255. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the qla2xxx driver bind to a Fibre Channel HBA whose advertised MSI-X vector count is a boundary value: 257 vectors (msix_count-1 == 256, truncates to u8 as 0), or exactly 1 (yields 0), or a target-mode configuration where the subsequent max_req_queues-- underflows 0 to 255. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a memory-safety flaw (integer truncation) in the Linux kernel qla2xxx QLogic Fibre Channel HBA driver. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches by upgrading to a fixed stable kernel: Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (7.3-rc1 and later also contain the fix), or cherry-pick the upstream commit for your branch - cf623d32761b00f221a9cfded3303d56e84b429d, 9eeddbeaa896f39d943644b16d83a6ad0ceab255, 802068b9b683b8008fcccbf6e9ad133e597ec87c, e80adfeac61b4d5db7ffe0f5af43999c33a4145e, 2efe50b2da829909023de4a2eb87badb7cfa53cc, 7a448f5ed0b283dbde4e9183dd1e98c221432dab, 33c77254e6e91f37c72c7fad4051777452b10de8 or ebfd35c64433821bd5619a6d07ccc2df8b5b1de3 - with the reference list available via https://nvd.nist.gov/vuln/detail/CVE-2026-89856. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux servers with QLogic Fibre Channel HBAs and the CONFIG_SCSI_QLA_FC driver, and identify any adapters reporting MSI-X vector counts of 256, 257, or exactly 1; review the referenced vendor advisory for affected kernel versions and apply the vendor-released patch immediately where feasible, or restrict physical and firmware-level access to those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today