« Volver al listado

CVE-2026-89515

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

During fuzz testing, the following issue was discovered:

Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000

When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem.

Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary.

Leer descripción completaMostrar menos

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Detalles técnicos trazas, registros y código del informe original
BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310
 __dma_map_sg_attrs+0x217/0x310
 dma_map_sg_attrs+0x4a/0x70
 ata_qc_issue+0x9f8/0x1420
 __ata_scsi_queuecmd+0x1657/0x1740
 ata_scsi_queuecmd+0x79a/0x920
 scsi_queue_rq+0x4472/0x4f40
 blk_mq_dispatch_rq_list+0x1cca/0x3ee0
 __blk_mq_sched_dispatch_requests+0x458/0x630
 blk_mq_sched_dispatch_requests+0x15b/0x340
 __blk_mq_run_hw_queue+0xe5/0x250
 __blk_mq_delay_run_hw_queue+0x138/0x780
 blk_mq_run_hw_queue+0x4bb/0x7e0
 blk_mq_sched_insert_request+0x2a7/0x4c0
 blk_execute_rq+0x497/0x8a0
 sg_io+0xbe0/0xe20
 scsi_ioctl+0x2b36/0x3c60
 sr_block_ioctl+0x319/0x440
 blkdev_ioctl+0x80f/0xd70
 __se_sys_ioctl+0x219/0x420
 __x64_sys_ioctl+0x93/0xe0
 x64_sys_call+0x1d6c/0x3ad0
 do_syscall_64+0x4c/0xa0
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Uninit was created at:
 __alloc_pages+0x5c0/0xc80
 alloc_pages+0xe0e/0x1050
 blk_rq_map_user_iov+0x2b77/0x6100
 blk_rq_map_user_io+0x2fa/0x4d0
 sg_io+0xad6/0xe20
 scsi_ioctl+0x2b36/0x3c60
 sr_block_ioctl+0x319/0x440
 blkdev_ioctl+0x80f/0xd70
 __se_sys_ioctl+0x219/0x420
 __x64_sys_ioctl+0x93/0xe0
 x64_sys_call+0x1d6c/0x3ad0
 do_syscall_64+0x4c/0xa0
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89515",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "28ed5343666ff424ce5e248fa1c5a402303b4aff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "a4353ec7742bdf87dcdde5875270feb3a1982a51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "e7143c3f4e5c0a7986733c6f27009274bf6c4264",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40b01b9bbdf51ae543a04744283bf2d56c4a6afa",
              "lessThan": "626147717bea776b61ed3631d2c26283760c4cc4",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/scsi/scsi_lib.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.25",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/scsi/scsi_lib.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:34.040",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()\n\nDuring fuzz testing, the following issue was discovered:\n\nBUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310\n __dma_map_sg_attrs+0x217/0x310\n dma_map_sg_attrs+0x4a/0x70\n ata_qc_issue+0x9f8/0x1420\n __ata_scsi_queuecmd+0x1657/0x1740\n ata_scsi_queuecmd+0x79a/0x920\n scsi_queue_rq+0x4472/0x4f40\n blk_mq_dispatch_rq_list+0x1cca/0x3ee0\n __blk_mq_sched_dispatch_requests+0x458/0x630\n blk_mq_sched_dispatch_requests+0x15b/0x340\n __blk_mq_run_hw_queue+0xe5/0x250\n __blk_mq_delay_run_hw_queue+0x138/0x780\n blk_mq_run_hw_queue+0x4bb/0x7e0\n blk_mq_sched_insert_request+0x2a7/0x4c0\n blk_execute_rq+0x497/0x8a0\n sg_io+0xbe0/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nUninit was created at:\n __alloc_pages+0x5c0/0xc80\n alloc_pages+0xe0e/0x1050\n blk_rq_map_user_iov+0x2b77/0x6100\n blk_rq_map_user_io+0x2fa/0x4d0\n sg_io+0xad6/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nBytes 14-15 of 16 are uninitialized\nMemory access of size 16 starts at ffff88800cbdb000\n\nWhen processing the last unaligned element of the scatterlist, it is\nsupplemented with missing bytes in the amount of pad_len.  These bytes\nremain uninitialized, which leads to a problem.\n\nExtend last_sg->length by pad_len first, then use sg_zero_buffer() to\nzero those pad_len bytes.  sg_zero_buffer() uses sg_miter internally,\nwhich correctly handles sg entries spanning multiple pages and padding\nthat crosses a page boundary.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
    }
  ],
  "lastModified": "2026-09-14T13:19:07.970",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}