CVE-2026-74470
Description
A flaw was found in the scsi_debug module of the Linux kernel. This vulnerability occurs in the resp_report_zones() function when handling specific allocation lengths, leading to an integer underflow. On 32-bit systems, this can cause an out-of-bounds write, which results in a kernel panic. A local attacker could exploit this to cause a denial of service (DoS).
Statement
scsi_debug REPORT ZONES can compute a 4 GB response buffer length from a large alloc_len value on 32-bit systems. The 4 GB size can truncate to 0 for kzalloc, so kzalloc(0) returns ZERO_SIZE_PTR and later descriptor writes are made past that pointer in resp_report_zones. A local actor that can issue raw SCSI commands to an affected scsi_debug zoned device can trigger a kernel OOB write and likely panic. For the CVSS the PR:L is used in the paranoid score because reliable triggering may only require local access to the scsi_debug device or an account allowed to send SG_IO style commands, while loading or configuring the debug device itself is usually administrative. The issue is not network reachable. Impact is at least local denial of service via kernel crash, and in the paranoid interpretation may include limited confidentiality or integrity impact because the failure mode is an OOB write rather than a pure NULL dereference.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
