CVE-2026-90112

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qlcnic: validate unified ROM sections before loading

The unified ROM parser reads directory, product, and data-descriptor fields

from the firmware file. Existing validation forms table and data ends with

unchecked additions and multiplications. Malformed values can wrap before

they are compared with the firmware size. The parser also dereferences

typed pointers at firmware-controlled offsets.

Valid descriptor extents alone are insufficient for the consumers. The

loader reads a fixed-size bootloader regardless of its declared size, the

version parser assumes a 17-byte tail, and a partial final firmware word is

read as a full u64. A truncated image can therefore make the driver read

beyond the firmware allocation during validation or loading.

Replace the pointer-returning parser with bounded range helpers. Validate

table entry sizes, descriptor indices, section ranges, the fixed

bootloader load length, and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References