Strix
64.9K

CVE-2026-98155

Unknown

Last modified

CVE-2026-98155 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker()..

Description

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 08021f2d4a557d6491e3bcc288e96425f50aa3cf, < f4b64488f3deca63f7fbc7d7c3835b2e668003f9; >= f403094d9075d7c565a3d81002b781c325cb3c07, < 12deeade460d47031267256ba07add51cc7eabd0; >= 2feec5ae5df785658924ab6bd91280dc3926507c, < c72e81ee46bdd4c221114d6e9515e9b4647616d7; >= 2feec5ae5df785658924ab6bd91280dc3926507c, < ab243f74ab4084ca5c8dec608cb5b0deb27db067; 2dd67966f39a2abf8ccb4865031c722e40e01b7f; ee0180e77e6c8482644569632065411de844c515; >= 6.12.81, < 6.12.111; >= 6.18.22, < 6.18.53; >= 6.6.134, < 6.7; >= 6.19.12, < 6.20
LinuxLinux7.0

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98155?
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().
How severe is CVE-2026-98155?
Severity scoring for CVE-2026-98155 is pending analysis.
How do I fix CVE-2026-98155?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98155?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST