CVE-2026-31464

In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()

A malicious or compromised VIO server can return a num_written value in the

discover targets MAD response that exceeds max_targets. This value is

stored directly in vhost->num_targets without validation, and is then used

as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which

is only allocated for max_targets entries. Indices at or beyond max_targets

access kernel memory outside the DMA-coherent allocation. The

out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI

MADs that are sent back to the VIO server, leaking kernel memory.

Fix by clamping num_written to max_targets before storing it.