Cloudanix VulnDB

CVE-2026-98386

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel driver bug can crash certain ARM64 servers that use specific QLogic storage adapters, causing unexpected downtime.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Plain memset() used on ioremapped device memory (request ring) instead of memset_io() emits invalid instructions (e.g. DC ZVA) on ARM64, triggering synchronous external abort.

Why it matters to the business

Unexpected kernel crashes or system instability on ARM64 servers using QLogic QLAFX00 Fibre Channel adapters, leading to downtime and potential data-path disruption.

How an attack unfolds

An attacker with the ability to trigger __qla2x00_alloc_iocbs() on a vulnerable ARM64 system causes the driver to perform an illegal memory operation on device memory, resulting in an immediate external abort and kernel panic. No remote code execution path is known.

How to fix it

Apply the upstream fix that replaces the memset() call with memset_io() for the QLAFX00 request ring; update to a kernel containing the resolution for the qla2xxx driver.

How to confirm the fix worked

Inspect the qla2xxx source for use of memset_io() at the producer-slot zeroing site; boot on ARM64 hardware with the adapter and confirm no external abort occurs during ring allocation.

Typical attack path

  1. Gain local execution or trigger I/O path that invokes qlafx00 IOCB allocation
  2. Driver calls __qla2x00_alloc_iocbs() which performs plain memset on ioremapped ring
  3. ARM64 CPU issues unsupported instruction against Device memory
  4. Synchronous external abort panics the kernel

How to detect it

Search kernel logs for synchronous external abort messages occurring during qla2xxx ring initialization or IOCB allocation; correlate with presence of QLAFX00 hardware.

  • synchronous external abort
  • qla2xxx
  • __qla2x00_alloc_iocbs

What your security team should do

  • Identify all ARM64 systems using qla2xxx QLAFX00 adapters and schedule kernel updates
  • Prioritize patching in production storage or SAN environments first
  • Monitor for external abort panics referencing qla2xxx until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory (ha->iobase + req_que_off), not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through memcpy_toio() and the wrt_reg_* helpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a plain memset(). On architectures such as ARM64 a regular memset() may emit unaligned or block-zeroing instructions (e.g. DC ZVA) that are invalid on Device memory, leading to a synchronous external abort. Use memset_io() to clear the slot for QLAFX00, matching the I/O accessors used elsewhere on this ring. Other adapters keep the plain memset() on their DMA-coherent rings. The zero-fill is retained for FX00 because its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of the entry and rely on the unused tail being pre-zeroed.

Affected packages

Ecosystem Package Introduced Fixed