{"id":"CVE-2026-74470","title":"scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ebacb44cb2042b90951140eda806bedad23ef554 < 7b615fc139e35c81077046df44725c532f7e2404","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 5d3e1d006bbb543259f9e31824caadbfff6a5465","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 49e5b25a0b74dbac595f122e5608fdce2918cc4e","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 495058429ca55ab7fcc21977b63b92907ad68066","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 2047ed09bf13453b7d6f9431b112ec07984dd69b","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < d6e6da6bc3b53231fac77ffab428da8173ee729c","Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 93dde0bf2f39a0f9f57fd610aa3201ce5b753433","Linux c4d2d7c935a4ad20e8e726ca10499cefe4537103","Linux >= 5.15.8 < 5.15.217","Linux >= 5.10.85 < 5.11","Linux 5.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:57:17.506626Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:47.666Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74470","references":[{"url":"https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404"},{"url":"https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465"},{"url":"https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e"},{"url":"https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066"},{"url":"https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b"},{"url":"https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c"},{"url":"https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02277,"ingestedAt":"2026-10-16T19:46:24.359Z","slug":"CVE-2026-74470","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -> out-of-bounds write / panic.\n\nClamp rep_max_zones to devip->nr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000.\n\n## Affected\n\n- `Linux >= ebacb44cb2042b90951140eda806bedad23ef554 < 7b615fc139e35c81077046df44725c532f7e2404`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 5d3e1d006bbb543259f9e31824caadbfff6a5465`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 49e5b25a0b74dbac595f122e5608fdce2918cc4e`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 495058429ca55ab7fcc21977b63b92907ad68066`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 2047ed09bf13453b7d6f9431b112ec07984dd69b`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < d6e6da6bc3b53231fac77ffab428da8173ee729c`\n- `Linux >= 7db0e0c8190a086ef92ce5bb960836cde49540aa < 93dde0bf2f39a0f9f57fd610aa3201ce5b753433`\n- `Linux c4d2d7c935a4ad20e8e726ca10499cefe4537103`\n- `Linux >= 5.15.8 < 5.15.217`\n- `Linux >= 5.10.85 < 5.11`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}