# scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd\[\]

CVE record · `CVE-2026-97529`

- **Identifiers:** `CVE-2026-97529`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 25 Sept 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 25 Sept 2026, 10:21 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before a0c6842ec825a91693626dbd9a4c54f2b9dc15ea` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before 0540676f5fefdff748b8d57a927b143e31dc21fd` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before d3762cc777544a4cbc4635a787e1cfc021e1a615` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before 5f33efe04658968b6b3f432f904d5f1f74c12286` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before ef63922d8bdea03de1804af39a6b12212acb1be2` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before 740f3458a4798af54aaf8cf63e797d407e8b6d3b` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before f75bff451a2fac5aed82f9641df1e9a42c5a899d` (git)
  - affected: `01e0e15c8b3b32e006e5cccac10c8b377ac3d803 to before 4cf38dd9465736141263ebb63375868311a0ec81` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.10`
  - unaffected: `before 4.10` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.112 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.53 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.7 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

> The Linux kernel qla2xxx driver is affected from 4.10 until the fixes in 5.10.273, 5.15.224, 6.1.191 and 6.6.160 and later stable releases. A user with CAP_SYS_RAWIO can send a short vendor FC BSG request, causing out-of-bounds heap reads that may crash the system. Upgrade the kernel to a fixed version.

Written 12 Nov 2026.

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 12th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 25 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-97529](https://www.cve.org/CVERecord?id=CVE-2026-97529)
- [NVD: CVE-2026-97529](https://nvd.nist.gov/vuln/detail/CVE-2026-97529)

### References from the CNA

- <https://git.kernel.org/stable/c/a0c6842ec825a91693626dbd9a4c54f2b9dc15ea>
- <https://git.kernel.org/stable/c/0540676f5fefdff748b8d57a927b143e31dc21fd>
- <https://git.kernel.org/stable/c/d3762cc777544a4cbc4635a787e1cfc021e1a615>
- <https://git.kernel.org/stable/c/5f33efe04658968b6b3f432f904d5f1f74c12286>
- <https://git.kernel.org/stable/c/ef63922d8bdea03de1804af39a6b12212acb1be2>
- <https://git.kernel.org/stable/c/740f3458a4798af54aaf8cf63e797d407e8b6d3b>
- <https://git.kernel.org/stable/c/f75bff451a2fac5aed82f9641df1e9a42c5a899d>
- <https://git.kernel.org/stable/c/4cf38dd9465736141263ebb63375868311a0ec81>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-97529>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-97529/>. Everything for agents: <https://agentprime.io/llms.txt>.