Home

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it.

PUBLISHED Reserved 2026-03-09 | Published 2026-04-22 | Updated 2026-04-27 | Assigner Linux




HIGH: 8.1CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Product status

Default status
unaffected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before d842348f8a00d5b1d7358f207eb34ffcf5b16df3
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before a007246cb6c9ebdc93dafbf63cc2d43d98f402cc
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before 394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before 4ed727e35b0ab17d3eeeb1e8023768396e2be161
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before d1466bf991b2343cf2ba8336e440c8faf3cbb780
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before 786f10b1966e485046839f992e89f2c18cbd1983
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before bae4df0a643fa7f84663473aa3082a9c2ed139db
affected

072b91f9c6510d0ec4a49d07dbc318760c7da7b3 (git) before 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f
affected

Default status
affected

2.6.27
affected

Any version before 2.6.27
unaffected

5.10.253 (semver)
unaffected

5.15.203 (semver)
unaffected

6.1.168 (semver)
unaffected

6.6.131 (semver)
unaffected

6.12.80 (semver)
unaffected

6.18.21 (semver)
unaffected

6.19.11 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3

git.kernel.org/...c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc

git.kernel.org/...c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89

git.kernel.org/...c/4ed727e35b0ab17d3eeeb1e8023768396e2be161

git.kernel.org/...c/d1466bf991b2343cf2ba8336e440c8faf3cbb780

git.kernel.org/...c/786f10b1966e485046839f992e89f2c18cbd1983

git.kernel.org/...c/bae4df0a643fa7f84663473aa3082a9c2ed139db

git.kernel.org/...c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f

cve.org (CVE-2026-31464)

nvd.nist.gov (CVE-2026-31464)

Download JSON