CVE-2026-97529

A moderate out-of-bounds read vulnerability exists in the Linux kernel qla2xxx Fibre Channel driver as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS images used by OpenShift Container Platform 4 and 5. The Fibre Channel BSG transport allocates the job request buffer with the exact user-supplied request_len, but for FC_BSG_HST_VENDOR requests the qla2xxx driver reads vendor_cmd[] selector bytes and command-specific structures without verifying that the buffer is long enough to contain them. A local attacker holding the CAP_SYS_RAWIO capability, which is required to submit BSG vendor requests, can send a truncated request with a matching vendor_id to trigger out-of-bounds heap reads, which can cause a kernel panic (denial of service), mis-selection of a vendor command, or disclosure of kernel memory. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream, and the Red Hat Enterprise Linux 6 Extended Lifecycle Support relationship is out of support scope. Red Hat rates the severity of this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local privileged access on systems using supported qla2xxx Fibre Channel adapters and the BSG device interface, and the flaw is not network-reachable. Fixes for the affected products are deferred because exploitation requires high local privileges and poses limited practical risk; the residual risk is denial of service or kernel memory disclosure by a locally privileged user.