VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97535: Linux kernel · scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

Source GCVE Database

Compare

Authoritative record:CVE-2026-97535· High

Not known to be exploited · fixed in c80a0362a0fe548c15a0324b1f61c04b62bb2174 : patch Linux kernel soon.

Data as of 30 Oct 2026, 17:33 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c80a0362a0fe548c15a0324b1f61c04b62bb2174, 878613ecb5a36db26859c4fd83daf9283a334fa2, 13354ad251ab009102597a791bc7c4d2265229e1 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-pfmp-h6h6-98gj

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < c80a0362a0fe548c15a0324b1f61c04b62bb2174	Fixed in c80a0362a0fe548c15a0324b1f61c04b62bb2174
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < 878613ecb5a36db26859c4fd83daf9283a334fa2	Fixed in 878613ecb5a36db26859c4fd83daf9283a334fa2
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < 13354ad251ab009102597a791bc7c4d2265229e1	Fixed in 13354ad251ab009102597a791bc7c4d2265229e1
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < 674d783f2e80d0d7c1c86bf36dc0a09033e704de	Fixed in 674d783f2e80d0d7c1c86bf36dc0a09033e704de
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < 48a44e19746eaa70320a3c2571dcb345192fca72	Fixed in 48a44e19746eaa70320a3c2571dcb345192fca72
LinuxLinux	Affected ≥ 2853192e154b813fe34a6cbee5e34dfef50d29d0, < 0c73631101e7889c519d4a621cc958f487f8e01a	Fixed in 0c73631101e7889c519d4a621cc958f487f8e01a

AI-suggested

The vulnerability has been resolved by adding bounds checks in the driver code to reject invalid vp_index values and prevent out-of-bounds writes. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated.

Description

CVE-2026-97535 is a vulnerability in the Linux kernel's qla2xxx SCSI driver where an out-of-bounds write can occur due to improper bounds checking of a virtual port index. The flaw arises because the code writes to an array index derived from the vp_index without ensuring it is within the fixed 16-byte bitmap size, potentially corrupting adjacent memory. This affects configurations where max_npiv_vports exceeds 128, but typical adapters with 63 or 127 NPIV vports are not impacted. The issue has been resolved by adding proper bounds checks to prevent out-of-bounds writes.

Impact

An out-of-bounds write vulnerability can lead to memory corruption in kernel space, potentially causing system instability or crashes. However, the impact is limited to systems with adapters reporting more than 128 NPIV virtual ports, which is uncommon. There is no indication of known exploitation in the wild.

Summary

The vulnerability in the Linux kernel qla2xxx driver involves the VP control IOCB bitmap, a fixed 16-byte array representing virtual ports. The function qla25xx_ctrlvp_iocb() calculates an index 'map' from the vp_index and writes to vp_idx_map[map] without verifying that 'map' is within the array bounds. Since max_npiv_vports can be as high as 191 or 255, vp_index values above 128 cause 'map' to be 16 or greater, leading to out-of-bounds writes of up to 16 bytes beyond the array. This corrupts adjacent IOCB fields or request-ring slots. The fix involves rejecting vp_index values that cannot be represented in the bitmap and adding defensive array size checks before writing.

References

Community reviews

Loading reviews…