libstoragemgmt suffers a stack buffer overflow when parsing SCSI Vital Product Data page 0x80. An attacker who can supply malformed page length data to the `_sg_parse_vpd_80()` function can trigger this overflow. The resulting corruption causes the process performing serial‑number queries to crash, leading to a denial of service. The flaw does not appear to provide a remote code execution path but can destabilize the storage‑management service.

The vulnerability affects Red Hat Enterprise Linux 7, 8, 9, and 10 distributions, as they all include the vulnerable libstoragemgmt component. No specific package or version of libstoragemgmt is listed, so all current installations are potentially impacted.

This flaw carries a CVSS score of 5.5, indicating moderate severity. The EPSS score is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to control a local or virtual storage device that can deliver crafted SCSI VPD data to the target system. Because the attack surface is the local storage interface, the likely attack vector is local. If an attacker can connect a malicious storage medium or virtual disk, they can trigger the overflow and cause the storage‑management process to terminate. The published workaround suggests filtering or rejecting malformed VPD page 0x80 data before it reaches libstoragemgmt.