The flaw is located in the Linux kernel SCSI subsystem’s scsi_cdl_enable() function. The function uses length fields returned by a device’s MODE SENSE command to calculate offsets into a 64‑byte stack buffer. If a target advertises a total length that is smaller than its mode header and block descriptors, the unsigned subtraction used for the MODE SELECT length can wrap. The resulting buffer pointer may reference memory beyond the 64‑byte buffer, allowing the kernel to read and then transmit up to 64 bytes of stack data back to the external device via a MODE SELECT command. The attack exposes kernel memory contents without requiring any filesystem mount or user‑space interaction, providing an information‑disclosure vector.

The vulnerability exists in every Linux kernel image that contains the unpatched scsi_cdl_enable() code. The data indicates that this issue is present in the core SCSI driver across all distributions. The only version boundary implied by the fix is the upstream commit that added bounds checks, meaning any kernel built before that commit may be vulnerable. There is no product or vendor filtering in the CPE list.

The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation yet. The flaw permits kernel memory disclosure via a local USB ATA device that advertises CDL support, without requiring filesystem or user‑space access. An attacker needs physical or logical access to the host’s USB ports to present the malicious device and can receive up to 64 bytes of stack data through a MODE SELECT response. The risk to confidentiality is significant; integrity and availability impacts are lower except in combination with other kernel issues.