CVE Vulnerability Catalog

In the Linux kernel, the scsi qla2xxx driver's qla2x00_update_fru_versions() function copies the user-supplied BSG request into a fixed 256-byte stack buffer and iterates list->count times without bounds, potentially reading past the buffer and sending kernel stack memory to the device.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_ls_reject_iocb() function lacks qpair locking when allocating and sending NVMe LS reject, potentially leading to concurrent access and corruption of the request ring state, causing duplicated or dropped commands.

In the Linux kernel scsi: qla2xxx driver, the queue count derived from the MSI-X vector count (msix_count - 1) is stored in a u8 field, causing truncation. With 257 MSI-X vectors the result 256 truncates to 0, and in target mode a further decrement underflows 0 to 255. When the count is 0, the allocation returns ZERO_SIZE_PTR, which is not NULL, so the check passes and the pointer is dereferenced, corrupting memory or crashing the kernel.

In the Linux kernel scsi: qla2xxx driver, the sysfs reset operation "update cache versions without reset" (0x20261) calls get_flash_version(), which reads hardware flash registers, without holding ha->optrom_mutex. The VPD update path serializes the same call under optrom_mutex, so the reset path can interleave its flash register accesses with a concurrent VPD or optrom flash operation and corrupt the reads.

In the Linux kernel scsi: qla2xxx driver, qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free.

In the Linux kernel scsi: qla2xxx driver, qla2x00_free_fce_trace() freed and cleared ha->fce while holding only fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the buffer) under hardware_lock and never take fce_mutex. A debugfs FCE disable could therefore free the DMA buffer between a dump's NULL check and its copy, resulting in a use-after-free.

In the Linux kernel scsi: qla2xxx driver, the mbx_cmd_t struct is allocated on the stack but left uninitialized. qla2x00_mailbox_command() has several early-return paths (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, purge mbox) that return without writing the input mailbox registers back into mcp->mb[]. qla2x00_get_firmware_state() then unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's states[] array regardless of the return value.

In the Linux kernel scsi: qla2xxx driver, qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value (0 on success, negative errno on failure) was assigned to the unsigned long enable flag, inverting the intended logic: a valid number was treated as "disable" while a parse failure enabled FCE.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_fw_state_show() re-issued the qla2x00_get_firmware_state() mailbox command outside optrom_mutex even when the chip was down or EEH was busy. This could hang the adapter during ISP reset or PCI error recovery.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla2xxx_delete_qpair() deleted the request queue before the response queue, leaving a window where the response MSI-X interrupt could dereference the freed rsp->req. This results in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_async_iocb_timeout() could call sp->done() twice when the response ISR completed the same handle before the timeout handler. This led to a write into a freed stack frame (use-after-free).

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() did not bound rsp_info_len from the target's FCP response, causing par_sense_len underflow and an out-of-bounds sense-data read when a hostile or buggy target reported a large value. This could leak adjacent heap memory into the sense buffer.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_error_entry() read ha->req_q_map[que] twice, so a concurrent NULL store by qla25xx_free_req_que() could result in a NULL pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla24xx_report_id_acquisition() format-1 path called qla_update_host_map() without holding vport_slock, allowing races with concurrent host_map updates and btree corruption.

In the Linux kernel, the scsi: qla2xxx driver's bsg handlers staged requests/replies in an uninitialized 256-byte stack buffer and copied the full structure back, leaking stale stack data. This affected qla2x00_read_fru_status() and qla2x00_read_i2c() among others.

In the Linux kernel, the scsi: qla2xxx driver's qla_nvme_xmt_ls_rsp() unconditionally called qla_nvme_ls_reject_iocb() even when firmware was not started, ringing the doorbell and queuing an IOCB that stopped firmware could not consume, and touching MMIO during the reset/EEH window.

In the Linux kernel, the f2fs filesystem's redirty_blocks() could run an extra cleanup loop iteration when read_cache_folio() failed before pinning any folios, causing folio_put_refs(folio, 2) to drop one reference too many. This led to "BUG: Bad page state" on later drop_caches or reclaim.

In the Linux kernel, f2fs F2FS_IOC_MOVE_RANGE checks the source range but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.

In the Linux kernel, f2fs f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap the VFS passes to the ->set() handler. On idmapped mounts this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner.