CVE-2026-53304: scsi: sg: Resolve soft lockup issue when opening /dev/sgX
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Resolve soft lockup issue when opening /dev/sgX
The parameter defreservedsize defines the default buffer size reserved for each Sgfd and should be restricted to a range between 0 and 1,048,576 (see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the function sgprocwritedressz enforces this limit, it is possible to bypass it by directly modifying the module parameter as shown below, which then causes a soft lockup:
echo -1 > /sys/module/sg/parameters/defreservedsize exec 4<> /dev/sg0
watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537] Modules loaded: CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134, PREEMPT disabled Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version 1.16.1-2.fc37 dated 04/01/2014 ... Call Trace:
sgbuildreserve+0x5c/0xa0 sgaddsfp+0x168/0x270 sgopen+0x16e/0x340 chrdevopen+0xbe/0x230 dodentryopen+0x175/0x480 vfsopen+0x34/0xf0 doopen+0x265/0x3d0 pathopenat+0x110/0x290 dofilpopen+0xc3/0x170 dosysopenat2+0x71/0xe0 x64sysopenat+0x6d/0xa0 dosyscall64+0x62/0x310 entrySYSCALL64afterhwframe+0x76/0x7e
The fix is to use moduleparamcb to validate and reject invalid values assigned to defreservedsize.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.19.0-rc3+ - Configuration
Do not set /sys/module/sg/parameters/def_reserved_size outside the allowed range; ensure it is constrained to between 0 and 1,048,576 because direct modification can bypass sg_proc_write_dressz validation and trigger a soft lockup when opening /dev/sgX.
scsi-generic (sg) kernel module def_reserved_size = Restrict to range 0 to 1048576 - Operational
Revert any unsafe value previously written to /sys/module/sg/parameters/def_reserved_size (e.g., values like -1 shown in the example) to an allowed value within 0 to 1,048,576.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53304?
The severity of CVE-2026-53304 is rated as 26.
How do I fix CVE-2026-53304?
To fix CVE-2026-53304, update the Linux kernel to the latest version that addresses this vulnerability.
What impacts does CVE-2026-53304 have on my system?
CVE-2026-53304 can cause soft lockup issues when opening /dev/sgX, affecting system stability.
Which versions of the Linux kernel are affected by CVE-2026-53304?
CVE-2026-53304 affects specific versions of the Linux kernel that do not enforce ranges on the def_reserved_size parameter.
Is there a workaround for CVE-2026-53304?
A workaround for CVE-2026-53304 may involve manually adjusting the def_reserved_size parameter within the allowed range until an update can be applied.