CVE-2026-89515: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fill in DMA padding bytes in scsiallocsgtables()
During fuzz testing, the following issue was discovered:
BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70 ataqcissue+0x9f8/0x1420 atascsiqueuecmd+0x1657/0x1740 atascsiqueuecmd+0x79a/0x920 scsiqueuerq+0x4472/0x4f40 blkmqdispatchrqlist+0x1cca/0x3ee0 blkmqscheddispatchrequests+0x458/0x630 blkmqscheddispatchrequests+0x15b/0x340 blkmqrunhwqueue+0xe5/0x250 blkmqdelayrunhwqueue+0x138/0x780 blkmqrunhwqueue+0x4bb/0x7e0 blkmqschedinsertrequest+0x2a7/0x4c0 blkexecuterq+0x497/0x8a0 sgio+0xbe0/0xe20 scsiioctl+0x2b36/0x3c60 srblockioctl+0x319/0x440 blkdevioctl+0x80f/0xd70 sesysioctl+0x219/0x420 x64sysioctl+0x93/0xe0 x64syscall+0x1d6c/0x3ad0 dosyscall64+0x4c/0xa0 entrySYSCALL64afterhwframe+0x6e/0xd8
Uninit was created at: allocpages+0x5c0/0xc80 allocpages+0xe0e/0x1050 blkrqmapuseriov+0x2b77/0x6100 blkrqmapuserio+0x2fa/0x4d0 sgio+0xad6/0xe20 scsiioctl+0x2b36/0x3c60 srblockioctl+0x319/0x440 blkdevioctl+0x80f/0xd70 sesysioctl+0x219/0x420 x64sysioctl+0x93/0xe0 x64syscall+0x1d6c/0x3ad0 dosyscall64+0x4c/0xa0 entrySYSCALL64afterhwframe+0x6e/0xd8
Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000
When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of padlen. These bytes remain uninitialized, which leads to a problem.
Extend lastsg->length by padlen first, then use sgzerobuffer() to zero those padlen bytes. sgzerobuffer() uses sgmiter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected Software
Event History
Frequently Asked Questions
Which systems are most directly exposed to this issue?
The reported path involves the Linux SCSI core, ATA command handling, and SG_IO requests issued through SCSI block-device ioctl handling. The reproducing stack includes a userspace ioctl request reaching sg_io and then DMA scatter-gather mapping.
What must occur for the uninitialized data to be used?
A request mapped from userspace I/O vectors reaches scsi_alloc_sgtables() and is subsequently DMA-mapped. The reported failure occurs in __dma_map_sg_attrs(), where DMA padding bytes can contain uninitialized data.
How can this issue be identified during testing?
The issue was found by fuzz testing with KMSAN, which reported an uninitialized-value use in __dma_map_sg_attrs(). A relevant trace includes ata_qc_issue, ata_scsi_queuecmd, sg_io, scsi_ioctl, and a block-device ioctl syscall.