UBUNTU-CVE-2026-89515: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70 ataqcissue+0x9f8/0x1420 atascsiqueuecmd+0x1657/0x1740 atascsiqueuecmd+0x79a/0x920 scsiqueuerq+0x4472/0x4f40 blkmqdispatchrqlist+0x1cca/0x3ee0 blkmqscheddispatchrequests+0x458/0x630 blkmqscheddispatchrequests+0x15b/0x340 blkmqrunhwqueue+0xe5/0x250 blkmqdelayrunhwqueue+0x138/0x780 blkmqrunhwqueue+0x4bb/0x7e0 blkmqschedinsertrequest+0x2a7/0x4c0 blkexecuterq+0x497/0x8a0 sgio+0xbe0/0xe20 scsiioctl+0x2b36/0x3c60 srblockioctl+0x319/0x440 blkdevioctl+0x80f/0xd70 sesysioctl+0x219/0x420 x64sysioctl+0x93/0xe0 x64syscall+0x1d6c/0x3ad0 dosyscall64+0x4c/0xa0 entrySYSCALL64afterhwframe+0x6e/0xd8 Uninit was created at: allocpages+0x5c0/0xc80 allocpages+0xe0e/0x1050 blkrqmapuseriov+0x2b77/0x6100 blkrqmapuserio+0x2fa/0x4d0 sgio+0xad6/0xe20 scsiioctl+0x2b36/0x3c60 srblockioctl+0x319/0x440 blkdevioctl+0x80f/0xd70 sesysioctl+0x219/0x420 x64sysioctl+0x93/0xe0 x64syscall+0x1d6c/0x3ad0 dosyscall64+0x4c/0xa0 entrySYSCALL64afterhwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of padlen. These bytes remain uninitialized, which leads to a problem. Extend lastsg->length by padlen first, then use sgzerobuffer() to zero those padlen bytes. sgzerobuffer() uses sgmiter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.