CVE-2026-53021

The vulnerability originates from an integer overflow in the sbc_execute_unmap function within the Linux kernel's SCSI target core. When a UNMAP command is processed, the function adds the logical block address (LBA) to the requested range without guarding against a 64‑bit overflow, allowing the sum to wrap around. This bypasses the bounds check that ensures the operation does not exceed the device capacity, potentially leading to kernel memory corruption and a system crash. The CVE description confirms the addition of an overflow guard as the fix, indicating that prior to the patch, this overflow was exploitable. This flaw could result in a denial of service by crashing the kernel.

Any Linux kernel version that does not contain the patch commit adding the overflow guard is affected. The defect exists in the generic SCSI target core module, so all distributions or custom builds that install the vulnerable kernel and provide SCSI UNMAP support are at risk. Versions from the earliest stable releases up to the commit date are vulnerable.

The CVSS score is 5.5, a moderate severity level that reflects the DoS potential. The EPSS score of < 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to have the ability to send crafted UNMAP requests to a target device, which typically requires local or privileged access to the SCSI subsystem. No public exploitation has been documented, so the threat remains theoretical pending successful memory corruption.