Executive brief
A vulnerability in the Linux kernel's SCSI generic (sg) driver could allow a user with administrative privileges to crash the system. By providing an invalid value to a specific driver setting, an attacker can trigger a 'soft lockup,' effectively freezing the processor and causing a denial of service. This affects systems using SCSI devices and has been resolved in recent kernel updates.
Technical details
A vulnerability exists in the Linux kernel SCSI generic (sg) driver (drivers/scsi/sg.c) where the 'def_reserved_size' module parameter lacks proper input validation when modified via sysfs. While the procfs interface (sg_proc_write_dressz) enforces a limit between 0 and 1,048,576 bytes, the module parameter interface allowed arbitrary integer values. Setting this to a negative value (e.g., -1) and subsequently opening a /dev/sgX device triggers a soft lockup in 'sg_build_reserve' due to improper buffer size handling. This is a local denial-of-service vulnerability requiring high privileges (root) to modify module parameters. The issue has been fixed by implementing a callback (module_param_cb) to validate and reject invalid values.
Affected products
- Linux Linux Kernel 6.19.0-rc3+; versions prior to fixes in stable branches
Timeline
- 2026-01-27: disclosed: Initial patch submission by Yang Erkun
- 2026-05-23: patched: Commits merged into stable branches by Greg Kroah-Hartman
- 2026-06-26: advisory: CVE-2026-53304 published
References
- https://git.kernel.org/stable/c/1afd963fcd963db0dc5d47df6dfcf010c9c4647e
- https://git.kernel.org/stable/c/3d74e0654ac908c65a8f20373091826fe43b1363
- https://git.kernel.org/stable/c/9676ca7b1ef31a3a65b3e61e7ce3b54ce7364202
- https://git.kernel.org/stable/c/c47ccfb3d80dfed522ca06a5954ac97488d78c5a
- https://git.kernel.org/stable/c/c5f4a211e82d04ccc1809311322c47023bbe66e2
- https://git.kernel.org/stable/c/d06a310b45e153872033dd0cf19d5a2279121099
- https://git.kernel.org/stable/c/fe671d3c84ffb1b763d590c25195755adeaadaba