CVE-2026-74470: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write
respreportzones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN() before deriving the descriptor count:
repmaxzones = (ALIGN((u64)alloclen, RZONESDESCHD) - RZONESDESCHD) >> ilog2(RZONESDESCHD); arrlen = (u64)RZONESDESCHD (repmaxzones + 1);
For alloclen in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arrlen is 4 GB. On 32-bit, kzalloc()'s sizet is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZEROSIZEPTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic.
Clamp repmaxzones to devip->nrzones. The loop already stops at sdebugcapacity (after nrzones zones), so a report can never hold more than nrzones descriptors; the clamp does not change the report, it only bounds arrlen to (nrzones + 1) RZONESDESCHD, a real device property that can never reach 0x100000000.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the upstream Linux kernel fix for “scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write” that clamps rep_max_zones to devip->nr_zones and rounds alloc_len up with ALIGN() before deriving the descriptor count to prevent out-of-bounds write/panic.
Linux kernel scsi_debug REPORT ZONES alloc_len underflow / OOB write handling = Implement v3 fix logic (clamp rep_max_zones to devip->nr_zones; round alloc_len up with ALIGN() before deriving descriptor count)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74470?
The severity of CVE-2026-74470 is rated as risk 44.
How do I fix CVE-2026-74470?
To fix CVE-2026-74470, you should update your Linux kernel to the latest version where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-74470?
CVE-2026-74470 is an out-of-bounds write vulnerability in the Linux kernel's SCSI subsystem.
What is affected by CVE-2026-74470?
The vulnerability affects the SCSI_DEBUG module in the Linux kernel related to the REPORT ZONES command.
When was CVE-2026-74470 published?
CVE-2026-74470 was published on August 15, 2026.