CVE-2026-97529 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

CVE-2026-97529 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

CVE-2026-97529

A vulnerability exists in the Linux kernel (scsi: qla2xxx) where the FC BSG transport allocates memory via memdup_user() based on a user-supplied request_len. Because fc_bsg_host_dispatch() does not account for the vendor_cmd[] flexible array, the qla2xxx driver may perform out-of-bounds heap rea...