Riskcovery

CVE-2024-36025

scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

State
Published
Severity
Not scored
Published
May 30, 2024
Updated
May 11, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs to be >= to prevent memory corruption.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7878f22a2e03b69baf792f74488962981a1c9547 to before 8c820f7c8e9b46238d277c575392fe9930207aabAffected
  • 7878f22a2e03b69baf792f74488962981a1c9547 to before 9fc74e367be4247a5ac39bb8ec41eaa73fade510Affected
  • 7878f22a2e03b69baf792f74488962981a1c9547 to before 60b87b5ecbe07d70897d35947b0bb3e76ccd1b3aAffected
  • 7878f22a2e03b69baf792f74488962981a1c9547 to before ea8ac95c22c93acecb710209a7fd10b851afe817Affected
  • 7878f22a2e03b69baf792f74488962981a1c9547 to before 4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbdAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.156 through 5.15.*Not affected
  • 6.1.87 through 6.1.*Not affected
  • 6.6.28 through 6.6.*Not affected
  • 6.8.7 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.