Cloudanix VulnDB

CVE-2026-98155

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel talks to certain accelerator cards can let a bad message from the hardware crash the whole computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds validation in resp_worker() allows a malformed device message to trigger out-of-bounds reads past slab allocations, potentially causing infinite loops or kernel panics in the accel/qaic driver.

Why it matters to the business

Systems using the affected accelerator hardware can experience sudden kernel crashes or instability, leading to unplanned downtime and loss of workloads that rely on the device.

How an attack unfolds

An attacker with the ability to craft and send malformed wire messages from a QAIC device supplies input that bypasses the bounds checks present in decode_message(), causing the kernel worker to read beyond allocated memory and trigger denial-of-service conditions.

How to fix it

Apply the upstream fix that calls decode_message() inside resp_worker() to restore bounds checking; rebuild and deploy the patched kernel on all systems exposing the qaic accelerator.

How to confirm the fix worked

Confirm the patch is present by inspecting the resp_worker() implementation for the decode_message() call; test with a fuzzed device response to ensure no out-of-bounds access occurs.

Typical attack path

  1. Obtain or emulate a QAIC device capable of sending custom responses
  2. Craft a malformed message lacking expected DEACTIVATE_FROM_DEV structure or containing invalid lengths
  3. Deliver the message to the resp_worker() path in the kernel driver
  4. Trigger out-of-bounds read, infinite loop, or kernel panic

How to detect it

Review kernel logs (dmesg, syslog) for oops traces, slab-out-of-bounds warnings, or panic messages mentioning qaic or resp_worker; correlate with device reset or error events from the accelerator.

What your security team should do

  • Prioritize kernel updates for any hosts with QAIC hardware attached
  • Monitor kernel logs for oops, panics, or slab corruption messages related to qaic
  • Restrict physical or virtual access to accelerator devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities