Executive brief
A Linux kernel memory initialization flaw in the SCSI subsystem allows uninitialized buffer data to be exposed during DMA scatter-gather operations. An attacker with local access to issue SCSI I/O commands could potentially leak sensitive kernel memory contents or cause system instability.
Technical details
The vulnerability exists in the SCSI core's scsi_alloc_sgtables() function, where DMA padding bytes added to unaligned scatter-gather list elements remain uninitialized. During DMA mapping operations (specifically in __dma_map_sg_attrs), these uninitialized bytes can be read, leading to kernel memory leakage. The vulnerability is triggered through the block I/O subsystem when processing unaligned scatter-gather entries that require padding. The fix involves properly zeroing the padding bytes using sg_zero_buffer() after extending the last scatter-gather entry length, ensuring all DMA data is initialized before hardware access.
Affected products
- Linux Linux kernel unfixed versions prior to the resolution
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fix available in kernel commits addressing scsi_alloc_sgtables()