VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90112: Linux kernel · net: qlcnic: validate unified ROM sections before loading

Source GCVE Database

Compare

Authoritative record:CVE-2026-90112· High

Not known to be exploited · fixed in b9efc177703a03312cc2f6e6a4bbd4595e8158a1 : patch Linux kernel soon.

Data as of 30 Oct 2026, 19:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in b9efc177703a03312cc2f6e6a4bbd4595e8158a1, ad6cceee7aca7762f90f155480c2cd8d11ec6914, 684773c4d26f7f2211beb31fb90629216f8a61f5 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-8m8v-32h4-xj63

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < b9efc177703a03312cc2f6e6a4bbd4595e8158a1	Fixed in b9efc177703a03312cc2f6e6a4bbd4595e8158a1
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < ad6cceee7aca7762f90f155480c2cd8d11ec6914	Fixed in ad6cceee7aca7762f90f155480c2cd8d11ec6914
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < 684773c4d26f7f2211beb31fb90629216f8a61f5	Fixed in 684773c4d26f7f2211beb31fb90629216f8a61f5
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < 43451ec94fb67ae1715faf29e9e6ab20ecbd42f4	Fixed in 43451ec94fb67ae1715faf29e9e6ab20ecbd42f4
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < 5e8076e4e4124dae75a3e080ddc20404700d7585	Fixed in 5e8076e4e4124dae75a3e080ddc20404700d7585
LinuxLinux	Affected ≥ af19b49152bdb68fda894183e88096d6d1aa5c3d, < 4be733a450c86938c91f9c70a56802ef5069764c	Fixed in 4be733a450c86938c91f9c70a56802ef5069764c

Description

A vulnerability in the Linux kernel's qlcnic driver involves improper validation of unified ROM sections before loading firmware. The flaw allows malformed firmware values to bypass size checks, potentially causing the driver to read beyond allocated firmware memory during validation or loading.

Impact

This vulnerability can lead to out-of-bounds memory reads during firmware validation or loading in the qlcnic driver, potentially causing kernel memory corruption or crashes. The description does not confirm exploitation in the wild or direct code execution, but improper memory access in kernel space poses a risk to system stability and security.

Summary

The Linux kernel qlcnic driver contains a vulnerability in its unified ROM parser, which reads directory, product, and data-descriptor fields from firmware files. The existing validation uses unchecked arithmetic operations that can wrap around, allowing malformed values to appear valid when compared against firmware size. Additionally, the parser dereferences pointers at firmware-controlled offsets without sufficient bounds checking. The loader reads fixed-size bootloader data regardless of declared size, and the version parser assumes a fixed tail length, which can cause out-of-bounds reads if the firmware image is truncated. The fix replaces pointer-returning parsing with bounded range helpers and validates all relevant sizes and indices before accessing firmware sections, ensuring safe unaligned little-endian reads and proper handling of partial final words.

References

Community reviews

Loading reviews…