CVE-2026-74470scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ebacb44cb2042b90951140eda806bedad23ef554 before 7b615fc139e35c81077046df44725c532f7e2404; 7db0e0c8190a086ef92ce5bb960836cde49540aa builds before 5d3e1d006bbb543259f9e31824caadbfff6a5465; from 7db0e0c8190a086ef92ce5bb960836cde49540aa before 49e5b25a0b74dbac595f122e5608fdce2918cc4e; from 7db0e0c8190a086ef92ce5bb960836cde49540aa before 495058429ca55ab7fcc21977b63b92907ad68066; from 7db0e0c8190a086ef92ce5bb960836cde49540aa before 2047ed09bf13453b7d6f9431b112ec07984dd69b; from 7db0e0c8190a086ef92ce5bb960836cde49540aa before d6e6da6bc3b53231fac77ffab428da8173ee729c; from 7db0e0c8190a086ef92ce5bb960836cde49540aa before 93dde0bf2f39a0f9f57fd610aa3201ce5b753433; c4d2d7c935a4ad20e8e726ca10499cefe4537103; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404
- https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465
- https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e
- https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066
- https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b
- https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c
- https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.