Executive brief
A vulnerability was identified in the Linux kernel's SCSI target core component, which manages how the system communicates with storage devices. An error in how the system validates storage addresses (LBAs) during 'UNMAP' operations could allow an attacker to bypass safety checks by causing a mathematical overflow. This could potentially lead to unauthorized memory access or system instability depending on the underlying storage configuration.
Technical details
An integer overflow vulnerability exists in the Linux kernel's SCSI target core within the `sbc_execute_unmap()` function in `drivers/target/target_core_sbc.c`. The function performs a bounds check to ensure that the Logical Block Address (LBA) plus the requested range does not exceed the device's capacity; however, it fails to account for 64-bit integer wrapping. An attacker providing a specially crafted LBA and range could cause the sum to wrap around, bypassing the capacity check. This could result in out-of-bounds operations on the storage backend. The issue has been resolved by adding an explicit overflow check (`lba + range < lba`) similar to existing checks in the `WRITE_SAME` command implementation.
Affected products
- Linux Linux Kernel 3.10 to 6.6.141
Timeline
- 2026-03-04: other: Vulnerability fixed in upstream commits
- 2026-06-24: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/02115986d027ade793e7f6be87e91d6a796d0aa3
- https://git.kernel.org/stable/c/2bf2d65f76697820dbc4227d13866293576dd90a
- https://git.kernel.org/stable/c/2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd
- https://git.kernel.org/stable/c/3facdecc3fcf115cc4f9b3d8f118d6705e2456a8
- https://git.kernel.org/stable/c/51075df70c46e60a9773f2dcd28299e40dac36fb
- https://git.kernel.org/stable/c/5efc3ef4758f8d98c257419fa21daca3227de61a
- https://git.kernel.org/stable/c/c08ab702c4699c6efb9d60bdb15b73e7a627ee7e