CVE-2026-89515 - Vulnerability Details

- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

During fuzz testing, the following issue was discovered:

BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310
__dma_map_sg_attrs+0x217/0x310
dma_map_sg_attrs+0x4a/0x70
ata_qc_issue+0x9f8/0x1420
__ata_scsi_queuecmd+0x1657/0x1740
ata_scsi_queuecmd+0x79a/0x920
scsi_queue_rq+0x4472/0x4f40
blk_mq_dispatch_rq_list+0x1cca/0x3ee0
__blk_mq_sched_dispatch_requests+0x458/0x630
blk_mq_sched_dispatch_requests+0x15b/0x340
__blk_mq_run_hw_queue+0xe5/0x250
__blk_mq_delay_run_hw_queue+0x138/0x780
blk_mq_run_hw_queue+0x4bb/0x7e0
blk_mq_sched_insert_request+0x2a7/0x4c0
blk_execute_rq+0x497/0x8a0
sg_io+0xbe0/0xe20
scsi_ioctl+0x2b36/0x3c60
sr_block_ioctl+0x319/0x440
blkdev_ioctl+0x80f/0xd70
__se_sys_ioctl+0x219/0x420
__x64_sys_ioctl+0x93/0xe0
x64_sys_call+0x1d6c/0x3ad0
do_syscall_64+0x4c/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Uninit was created at:
__alloc_pages+0x5c0/0xc80
alloc_pages+0xe0e/0x1050
blk_rq_map_user_iov+0x2b77/0x6100
blk_rq_map_user_io+0x2fa/0x4d0
sg_io+0xad6/0xe20
scsi_ioctl+0x2b36/0x3c60
sr_block_ioctl+0x319/0x440
blkdev_ioctl+0x80f/0xd70
__se_sys_ioctl+0x219/0x420
__x64_sys_ioctl+0x93/0xe0
x64_sys_call+0x1d6c/0x3ad0
do_syscall_64+0x4c/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Bytes 14-15 of 16 are uninitialized
Memory access of size 16 starts at ffff88800cbdb000

When processing the last unaligned element of the scatterlist, it is
supplemented with missing bytes in the amount of pad_len. These bytes
remain uninitialized, which leads to a problem.

Extend last_sg->length by pad_len first, then use sg_zero_buffer() to
zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally,
which correctly handles sg entries spanning multiple pages and padding
that crosses a page boundary.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published: 2026-09-11

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s SCSI core builds scatter‑list tables with padding bytes that are not cleared. Fuzz testing uncovered that the last scatter‑list entry is supplemented with uninitialized storage. When a SCSI command is sent from user space via ioctl, the kernel copies this padding into the command buffer. Based on the description, it is inferred that the uninitialized bytes may be transmitted to the device, potentially exposing data that previously resided in memory or corrupting the command payload.

Affected Systems

All Linux kernel releases that contain the legacy SCSI core implementation and have not applied the patch identified by commit 6261477. The vulnerability affects the SCSI core subsystem and the DMA mapping routines that construct scatter‑list tables. No specific version range is supplied, so any kernel version prior to the patch is potentially impacted.

Risk and Exploitability

The vulnerability is scored with a CVSS base score of 6.3. The EPSS score is <1%, indicating very low but nonzero exploitation probability. The issue is not listed in the CISA KEV catalog. Given the local nature of the required access through user‑space SCSI ioctl commands, the risk remains moderate but remediation is advised.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`40b01b9bbdf51ae543a04744283bf2d56c4a6afa`	affected	< a4353ec7742bdf87dcdde5875270feb3a1982a51
`40b01b9bbdf51ae543a04744283bf2d56c4a6afa`	affected	< e7143c3f4e5c0a7986733c6f27009274bf6c4264
`40b01b9bbdf51ae543a04744283bf2d56c4a6afa`	affected	< 6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409
`40b01b9bbdf51ae543a04744283bf2d56c4a6afa`	affected	< 626147717bea776b61ed3631d2c26283760c4cc4

Linux

affected

Version	Status	Constraints
`2.6.25`	affected	—
`0`	unaffected	< 2.6.25
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[40b01b9bbdf51ae543a04744283bf2d56c4a6afa,a4353ec7742bdf87dcdde5875270feb3a1982a51)`	affected	code_commit	—
`[40b01b9bbdf51ae543a04744283bf2d56c4a6afa,e7143c3f4e5c0a7986733c6f27009274bf6c4264)`	affected	code_commit	—
`[40b01b9bbdf51ae543a04744283bf2d56c4a6afa,6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409)`	affected	code_commit	—
`[40b01b9bbdf51ae543a04744283bf2d56c4a6afa,626147717bea776b61ed3631d2c26283760c4cc4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.25`	affected	semver	—
`[0,2.6.25)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply any kernel update that includes the scsi_alloc_sgtables patch (commit 6261477).
If an update cannot be applied immediately, restrict or remove access to user‑space SCSI interfaces such as /dev/sg* to prevent the transmission of uninitialized padding.
Use SELinux, AppArmor profiles, or a cgroup policy to limit which processes may issue ioctl calls to SCSI devices.

Generated by OpenCVE AI on September 13, 2026 at 04:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4
https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409
https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51
https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264
https://nvd.nist.gov/vuln/detail/CVE-2026-89515
https://www.cve.org/CVERecord?id=CVE-2026-89515

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89515 https://www.cve.org/CVERecord?id=CVE-2026-89515
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310 __dma_map_sg_attrs+0x217/0x310 dma_map_sg_attrs+0x4a/0x70 ata_qc_issue+0x9f8/0x1420 __ata_scsi_queuecmd+0x1657/0x1740 ata_scsi_queuecmd+0x79a/0x920 scsi_queue_rq+0x4472/0x4f40 blk_mq_dispatch_rq_list+0x1cca/0x3ee0 __blk_mq_sched_dispatch_requests+0x458/0x630 blk_mq_sched_dispatch_requests+0x15b/0x340 __blk_mq_run_hw_queue+0xe5/0x250 __blk_mq_delay_run_hw_queue+0x138/0x780 blk_mq_run_hw_queue+0x4bb/0x7e0 blk_mq_sched_insert_request+0x2a7/0x4c0 blk_execute_rq+0x497/0x8a0 sg_io+0xbe0/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Uninit was created at: __alloc_pages+0x5c0/0xc80 alloc_pages+0xe0e/0x1050 blk_rq_map_user_iov+0x2b77/0x6100 blk_rq_map_user_io+0x2fa/0x4d0 sg_io+0xad6/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem. Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title		scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4 https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409 https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51 https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:59.300Z

Updated: 2026-09-11T19:43:59.300Z

Reserved: 2026-09-11T19:38:34.717Z

Link: CVE-2026-89515

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:34.040

Modified: 2026-09-11T20:19:34.040

Link: CVE-2026-89515

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:59Z

Links: CVE-2026-89515 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T15:15:07Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object