CVE-2026-74470
Received Received - Intake

scsi_debug REPORT ZONES alloc_len underflow OOB write

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74470
EUVD
EUVD-2026-59663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's scsi_debug module. It involves an out-of-bounds write issue in the REPORT ZONES command handling. When the allocation length in the command is manipulated to a specific range (0xFFFFFFC1 to 0xFFFFFFFF), the kernel miscalculates the required buffer size, leading to a potential buffer overflow when writing zone descriptors.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI subsystem and the scsi_debug module. Detection requires checking for the affected kernel version and the presence of the vulnerable scsi_debug module. Use commands like 'uname -a' to check kernel version and 'lsmod | grep scsi_debug' to see if the module is loaded.

Impact Analysis

This vulnerability could cause a system crash or kernel panic due to an out-of-bounds memory write. On 32-bit systems, it may lead to a denial of service by corrupting kernel memory. Attackers with access to the affected system could exploit this to trigger system instability.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for this vulnerability. If the scsi_debug module is not required, unload it using 'rmmod scsi_debug'. If it is required, ensure the kernel is updated to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart