CVE-2026-23059: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23059 is a buffer overflow vulnerability in the Linux kernel's SCSI qla2xxx driver (QLogic Fibre Channel HBA driver). Specifically, in the functions qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), a firmware-reported frame_size value is used to calculate the copy length into item->iocb, a fixed-size 64-byte array within struct purex_item. If frame_size exceeds 64 bytes, subsequent memcpy calls overflow the iocb member boundary, constituting an out-of-bounds write. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from commit 875386b98857822b77ac7f95bdf367b70af5b78c up to the patched commits across stable branches. The EPSS score is approximately 0.018% (very low), and no CVSS base score has been formally assigned at this time (Feedly, EUVD).

The root cause is a missing bounds check (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the qla2xxx SCSI driver. The frame_size value originates from firmware-reported data in FPIN (Fabric Performance Impact Notification) packet handling; if a malicious or malformed firmware value exceeds 64 bytes, the memcpy into the fixed-size iocb member of struct purex_item writes beyond the member's boundary into adjacent struct memory. This cross-member write is unsafe and triggers kernel warnings under CONFIG_FORTIFY_SOURCE. The fix caps total_bytes to sizeof(item->iocb) (64 bytes) before allocation and copying, ensuring all copies remain within bounds (Feedly, Kernel Patch 1, Kernel Patch 2).

Exploitation of this vulnerability could allow an attacker with the ability to influence firmware-reported frame sizes (e.g., via a malicious or compromised Fibre Channel fabric) to corrupt kernel memory adjacent to the iocb member in struct purex_item, potentially leading to kernel crashes (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The impact is primarily local to systems using QLogic QLA27xx Fibre Channel HBAs, and the practical exploitability for remote attackers is limited by the requirement to interact with the Fibre Channel fabric layer (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux kernel 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7, with patches applied at commits 408bfa8d70f79ac696cec1bdbdfb3bf43a02e6d0, 1922468a4a80424e5a69f7ba50adcee37f4722e9, aa14451fa5d5f2de919384c637e2a8c604e1a1fe, and 19bc5f2a6962dfaa0e32d0e0bc2271993d85d414. Downstream distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8296-2, USN-8278-2, USN-8393-1) and Oracle Linux (ELSA-2026-50160, ELSA-2026-50232, ELSA-2026-50261) have issued updated kernel packages. Administrators should update to a patched kernel version as soon as possible; no configuration-based workaround is available short of disabling the qla2xxx driver on affected hardware (Ubuntu USN-8278-1, Feedly).