CVE-2026-23059
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Sanitize payload size to prevent member overflow
In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item.
If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE.
Leer descripción completaMostrar menos
Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member.
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-23059",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"lessThan": "408bfa8d70f79ac696cec1bdbdfb3bf43a02e6d0",
"versionType": "git"
},
{
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"lessThan": "1922468a4a80424e5a69f7ba50adcee37f4722e9",
"versionType": "git"
},
{
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"lessThan": "aa14451fa5d5f2de919384c637e2a8c604e1a1fe",
"versionType": "git"
},
{
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"lessThan": "19bc5f2a6962dfaa0e32d0e0bc2271993d85d414",
"versionType": "git"
}
],
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.122",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.68",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.8",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-02-04T17:16:16.583",
"references": [
{
"url": "https://git.kernel.org/stable/c/1922468a4a80424e5a69f7ba50adcee37f4722e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/19bc5f2a6962dfaa0e32d0e0bc2271993d85d414",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/408bfa8d70f79ac696cec1bdbdfb3bf43a02e6d0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aa14451fa5d5f2de919384c637e2a8c604e1a1fe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Deferred",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Sanitize payload size to prevent member overflow\n\nIn qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size\nreported by firmware is used to calculate the copy length into\nitem->iocb. However, the iocb member is defined as a fixed-size 64-byte\narray within struct purex_item.\n\nIf the reported frame_size exceeds 64 bytes, subsequent memcpy calls will\noverflow the iocb member boundary. While extra memory might be allocated,\nthis cross-member write is unsafe and triggers warnings under\nCONFIG_FORTIFY_SOURCE.\n\nFix this by capping total_bytes to the size of the iocb member (64 bytes)\nbefore allocation and copying. This ensures all copies remain within the\nbounds of the destination structure member."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: qla2xxx: Sanitizar el tamaño de la carga útil para prevenir el desbordamiento de miembro\n\nEn qla27xx_copy_fpin_pkt() y qla27xx_copy_multiple_pkt(), el frame_size reportado por el firmware se utiliza para calcular la longitud de la copia en item->iocb. Sin embargo, el miembro iocb se define como un array de tamaño fijo de 64 bytes dentro de la estructura purex_item.\n\nSi el frame_size reportado excede los 64 bytes, las llamadas subsiguientes a memcpy desbordarán el límite del miembro iocb. Aunque se podría asignar memoria adicional, esta escritura entre miembros es insegura y activa advertencias bajo CONFIG_FORTIFY_SOURCE.\n\nSolucione esto limitando total_bytes al tamaño del miembro iocb (64 bytes) antes de la asignación y la copia. Esto asegura que todas las copias permanezcan dentro de los límites del miembro de la estructura de destino."
}
],
"lastModified": "2026-06-17T10:20:47.323",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}