Executive brief
A vulnerability was identified in the Linux kernel's SCSI target subsystem, which manages how the system presents storage devices to other computers on a network. A flaw in how the system handles long device or adapter names could allow a local user to trigger a buffer overflow. This could lead to a system crash or potentially allow unauthorized access to sensitive kernel memory, impacting the stability and security of the storage server.
Technical details
A buffer overflow exists in the 'target_lu_gp_members_show' function within 'drivers/target/target_core_configfs.c'. The vulnerability is caused by improper handling of the 'snprintf' return value when formatting HBA and device names into a 256-byte buffer (LU_GROUP_NAME_BUF). Because 'snprintf' returns the length of the string that *would* have been written, a sufficiently long combined string can cause a subsequent 'memcpy' operation to exceed the allocated buffer bounds. A local attacker with low privileges can exploit this to trigger a kernel crash (DoS) or potentially read out-of-bounds kernel memory. The issue has been resolved by adding explicit length checks for 'cur_len' against 'LU_GROUP_NAME_BUF'.
Affected products
- Linux Linux Kernel 2.6.38 to 6.11.x
Timeline
- 2025-09-20: disclosed: Vulnerability reported by Wang Haoran
- 2025-09-29: patched: Initial patch committed to mainline kernel
- 2025-10-15: advisory: CVE published
References
- https://git.kernel.org/stable/c/27e06650a5eafe832a90fd2604f0c5e920857fae
- https://git.kernel.org/stable/c/4b292286949588bd2818e66ff102db278de8dd26
- https://git.kernel.org/stable/c/53c6351597e6a17ec6619f6f060d54128cb9a187
- https://git.kernel.org/stable/c/764a91e2fc9639e07aac93bc70e387e6b1e33084
- https://git.kernel.org/stable/c/a150275831b765b0f1de8b8ff52ec5c6933ac15d
- https://git.kernel.org/stable/c/ddc79fba132b807ff775467acceaf48b456e008b
- https://git.kernel.org/stable/c/e6eeee5dc0d9221ff96d1b229b1d0222c8871b84