The scsi_debug module in the Linux kernel erroneously sizes the REPORT ZONES reply buffer based on an unvalidated allocation length field. For allocation lengths in the 0xFFFFFFC1..0xFFFFFFFF range, the calculation overflows to 4 GB; on 32‑bit systems this truncates to zero, leading to a kzalloc(0) that returns a zero‑size pointer. The code then dereferences this pointer and writes out of bounds, causing a kernel panic or, potentially, arbitrary memory corruption. This flaw can be triggered by sending a malicious REPORT ZONES command to a scsi_debug target, providing a denial of service or a vector for privilege escalation in systems that allow such access. This is a classic instance of CWE‑787, an out‑of‑bounds write.

Any Linux kernel that loads the scsi_debug module and processes REPORT ZONES commands is affected. The vulnerability applies to 32‑bit kernel configurations; 64‑bit builds are not vulnerable due to the larger address space preventing the size truncation. Specific kernel versions are not listed, but the fix is included in subsequent kernel releases after the commit referenced in the advisory.

The CVSS score is 7.8 and the EPSS score is < 1%. The flaw can cause a kernel panic when a REPORT ZONES command is issued. The vulnerability is not in the CISA KEV catalog and no public exploits have been reported. The only access required is the ability to send a REPORT ZONES command to a scsi_debug device, which is normally limited to privileged users or local administrators. Based on the description, the likely attack vector involves a local user or process sending a crafted REPORT ZONES command to the scsi_debug target. Therefore, the likelihood of exploitation is low in environments with restricted access, but the impact of a successful attack is high.