{"id":"CVE-2026-31464","state":"PUBLISHED","title":"scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n\nA malicious or compromised VIO server can return a num_written value in the\ndiscover targets MAD response that exceeds max_targets. This value is\nstored directly in vhost->num_targets without validation, and is then used\nas the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which\nis only allocated for max_targets entries. Indices at or beyond max_targets\naccess kernel memory outside the DMA-coherent allocation.  The\nout-of-bounds data is subsequently embedded in Implicit Logout and PLOGI\nMADs that are sent back to the VIO server, leaking kernel memory.\n\nFix by clamping num_written to max_targets before storing it.","publishedAt":"2026-04-22T13:53:54.970Z","updatedAt":"2026-10-19T18:35:49.523Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"d842348f8a00d5b1d7358f207eb34ffcf5b16df3","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"a007246cb6c9ebdc93dafbf63cc2d43d98f402cc","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"4ed727e35b0ab17d3eeeb1e8023768396e2be161","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"d1466bf991b2343cf2ba8336e440c8faf3cbb780","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"786f10b1966e485046839f992e89f2c18cbd1983","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"bae4df0a643fa7f84663473aa3082a9c2ed139db","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.27","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"]}],"references":["https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3","https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc","https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89","https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161","https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780","https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983","https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db","https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31464.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31464","state":"PUBLISHED","datePublished":"2026-04-22T13:53:54.970Z","dateUpdated":"2026-10-19T18:35:49.523Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.097Z"},"containers":{"cna":{"title":"scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n\nA malicious or compromised VIO server can return a num_written value in the\ndiscover targets MAD response that exceeds max_targets. This value is\nstored directly in vhost->num_targets without validation, and is then used\nas the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which\nis only allocated for max_targets entries. Indices at or beyond max_targets\naccess kernel memory outside the DMA-coherent allocation.  The\nout-of-bounds data is subsequently embedded in Implicit Logout and PLOGI\nMADs that are sent back to the VIO server, leaking kernel memory.\n\nFix by clamping num_written to max_targets before storing it."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"d842348f8a00d5b1d7358f207eb34ffcf5b16df3","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"a007246cb6c9ebdc93dafbf63cc2d43d98f402cc","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"4ed727e35b0ab17d3eeeb1e8023768396e2be161","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"d1466bf991b2343cf2ba8336e440c8faf3cbb780","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"786f10b1966e485046839f992e89f2c18cbd1983","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"bae4df0a643fa7f84663473aa3082a9c2ed139db","versionType":"git"},{"version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","status":"affected","lessThan":"61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.27","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3"},{"url":"https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc"},{"url":"https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89"},{"url":"https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161"},{"url":"https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780"},{"url":"https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983"},{"url":"https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db"},{"url":"https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - Reachable through IBM Power VIO virtual Fibre Channel CRQ/MAD responses from the backing VIO server on the same virtual I/O fabric, not through a local syscall or routable network path.\nAC:L - A malicious or compromised VIO server directly controls the `num_written` value in the Discover Targets response; no race or hard-to-control condition is required once the adapter is initialized.\nPR:N - No privilege or authentication check in the Linux guest gates this completion path; the crafted response is accepted from the configured VIO partner.\nUI:N - The vulnerable discovery flow runs during adapter initialization/reinitialization and processes the VIO server response without requiring any end-user action.\nS:U - The impact is on the guest Linux kernel/driver resources that process the malicious virtual device response; this is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - The excessive `num_written` causes out-of-bounds reads beyond the discovery buffer, and the derived values are sent back to the VIO server in Implicit Logout/PLOGI MADs, leaking kernel memory.\nI:N - The investigated bug is an out-of-bounds read used to construct outbound MAD fields; I did not find an out-of-bounds write or arbitrary kernel memory modification primitive.\nA:H - The server-controlled oversized count can drive reads far beyond the DMA-coherent allocation and create excessive target-processing work, making kernel oops, hang, or resource exhaustion plausible."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:22:45.348Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.27","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31464","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:09:42.415310Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:35:49.523Z"}}]}}}