Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74470

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ebacb44cb2042b90951140eda806bedad23ef554 to < 7b615fc139e35c81077046df44725c532f7e2404affected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < 5d3e1d006bbb543259f9e31824caadbfff6a5465affected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < 49e5b25a0b74dbac595f122e5608fdce2918cc4eaffected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < 495058429ca55ab7fcc21977b63b92907ad68066affected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < 2047ed09bf13453b7d6f9431b112ec07984dd69baffected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < d6e6da6bc3b53231fac77ffab428da8173ee729caffected
  • 7db0e0c8190a086ef92ce5bb960836cde49540aa to < 93dde0bf2f39a0f9f57fd610aa3201ce5b753433affected
  • c4d2d7c935a4ad20e8e726ca10499cefe4537103affected
  • 5.15.8 to < 5.15.217affected
  • 5.10.85 to < 5.11affected

Linux Linux

Default version status: affected

  • 5.16affected
  • 0 to < 5.16unaffected
  • 5.15.217 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.151 to ≤ 6.6.*unaffected
  • 6.12.103 to ≤ 6.12.*unaffected
  • 6.18.44 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References