CVE-2026-90112 (GCVE-0-2026-90112)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions and multiplications. Malformed values can wrap before they are compared with the firmware size. The parser also dereferences typed pointers at firmware-controlled offsets. Valid descriptor extents alone are insufficient for the consumers. The loader reads a fixed-size bootloader regardless of its declared size, the version parser assumes a 17-byte tail, and a partial final firmware word is read as a full u64. A truncated image can therefore make the driver read beyond the firmware allocation during validation or loading. Replace the pointer-returning parser with bounded range helpers. Validate table entry sizes, descriptor indices, section ranges, the fixed bootloader load length, and the version tail before exposing any section. Read all file fields with unaligned little-endian accessors and assemble a partial final word from only the bytes that remain. Apply the same range checks to the legacy image before reading its fixed fields.
References
Impacted products
Vendor Product Version
Linux Linux Version: af19b49152bdb68fda894183e88096d6d1aa5c3d
Version: af19b49152bdb68fda894183e88096d6d1aa5c3d
Version: af19b49152bdb68fda894183e88096d6d1aa5c3d
Version: af19b49152bdb68fda894183e88096d6d1aa5c3d
Version: af19b49152bdb68fda894183e88096d6d1aa5c3d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "43451ec94fb67ae1715faf29e9e6ab20ecbd42f4",
              "status": "affected",
              "version": "af19b49152bdb68fda894183e88096d6d1aa5c3d",
              "versionType": "git"
            },
            {
              "lessThan": "b9efc177703a03312cc2f6e6a4bbd4595e8158a1",
              "status": "affected",
              "version": "af19b49152bdb68fda894183e88096d6d1aa5c3d",
              "versionType": "git"
            },
            {
              "lessThan": "4be733a450c86938c91f9c70a56802ef5069764c",
              "status": "affected",
              "version": "af19b49152bdb68fda894183e88096d6d1aa5c3d",
              "versionType": "git"
            },
            {
              "lessThan": "684773c4d26f7f2211beb31fb90629216f8a61f5",
              "status": "affected",
              "version": "af19b49152bdb68fda894183e88096d6d1aa5c3d",
              "versionType": "git"
            },
            {
              "lessThan": "5e8076e4e4124dae75a3e080ddc20404700d7585",
              "status": "affected",
              "version": "af19b49152bdb68fda894183e88096d6d1aa5c3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlcnic: validate unified ROM sections before loading\n\nThe unified ROM parser reads directory, product, and data-descriptor fields\nfrom the firmware file.  Existing validation forms table and data ends with\nunchecked additions and multiplications.  Malformed values can wrap before\nthey are compared with the firmware size.  The parser also dereferences\ntyped pointers at firmware-controlled offsets.\n\nValid descriptor extents alone are insufficient for the consumers.  The\nloader reads a fixed-size bootloader regardless of its declared size, the\nversion parser assumes a 17-byte tail, and a partial final firmware word is\nread as a full u64.  A truncated image can therefore make the driver read\nbeyond the firmware allocation during validation or loading.\n\nReplace the pointer-returning parser with bounded range helpers.  Validate\ntable entry sizes, descriptor indices, section ranges, the fixed\nbootloader load length, and the version tail before exposing any section.\nRead all file fields with unaligned little-endian accessors and assemble a\npartial final word from only the bytes that remain.  Apply the same range\nchecks to the legacy image before reading its fixed fields."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:49:57.033Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/43451ec94fb67ae1715faf29e9e6ab20ecbd42f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9efc177703a03312cc2f6e6a4bbd4595e8158a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4be733a450c86938c91f9c70a56802ef5069764c"
        },
        {
          "url": "https://git.kernel.org/stable/c/684773c4d26f7f2211beb31fb90629216f8a61f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e8076e4e4124dae75a3e080ddc20404700d7585"
        }
      ],
      "title": "net: qlcnic: validate unified ROM sections before loading",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90112",
    "datePublished": "2026-09-17T16:06:19.419Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-10-21T12:49:57.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.