Junglewise Threat Intelligence

CVE-2026-53304: Linux Kernel soft lockup in SCSI generic driver

CVE-2026-53304 · Severity: info · CVSS 5.5 · Published 2026-06-26

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SCSI generic (sg) driver could allow a user with administrative privileges to crash the system. By providing an invalid value to a specific driver setting, an attacker can trigger a 'soft lockup,' effectively freezing the processor and causing a denial of service. This affects systems using SCSI devices and has been resolved in recent kernel updates.

Technical details

A vulnerability exists in the Linux kernel SCSI generic (sg) driver (drivers/scsi/sg.c) where the 'def_reserved_size' module parameter lacks proper input validation when modified via sysfs. While the procfs interface (sg_proc_write_dressz) enforces a limit between 0 and 1,048,576 bytes, the module parameter interface allowed arbitrary integer values. Setting this to a negative value (e.g., -1) and subsequently opening a /dev/sgX device triggers a soft lockup in 'sg_build_reserve' due to improper buffer size handling. This is a local denial-of-service vulnerability requiring high privileges (root) to modify module parameters. The issue has been fixed by implementing a callback (module_param_cb) to validate and reject invalid values.

Affected products

  • Linux Linux Kernel 6.19.0-rc3+; versions prior to fixes in stable branches

Timeline

  • 2026-01-27: disclosed: Initial patch submission by Yang Erkun
  • 2026-05-23: patched: Commits merged into stable branches by Greg Kroah-Hartman
  • 2026-06-26: advisory: CVE-2026-53304 published

References

Related threats