CVE-2026-23059

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the scsi subsystem, specifically in the qla2xxx driver. The qla27xx copy fpin pkt() and qla27xx copy multiple pkt() functions use the frame size reported by firmware to determine the length of data to copy into the iocb member of the purex item structure. However, iocb is a fixed-size 64-byte array. If frame size exceeds 64 bytes, the memcpy calls will write beyond the bounds of the iocb member, causing a buffer overflow. This is considered unsafe and may trigger warnings when CONFIG FORTIFY SOURCE is enabled. The issue is addressed by limiting the total bytes value to the size of the iocb member (64 bytes) before allocation and copying, ensuring data remains within the structure's boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.