CVE-2026-74470

A flaw was found in the scsi_debug module of the Linux kernel. This vulnerability occurs in the resp_report_zones() function when handling specific allocation lengths, leading to an integer underflow. On 32-bit systems, this can cause an out-of-bounds write, which results in a kernel panic. A local attacker could exploit this to cause a denial of service (DoS).

scsi_debug REPORT ZONES can compute a 4 GB response buffer length from a large alloc_len value on 32-bit systems. The 4 GB size can truncate to 0 for kzalloc, so kzalloc(0) returns ZERO_SIZE_PTR and later descriptor writes are made past that pointer in resp_report_zones. A local actor that can issue raw SCSI commands to an affected scsi_debug zoned device can trigger a kernel OOB write and likely panic. For the CVSS the PR:L is used in the paranoid score because reliable triggering may only require local access to the scsi_debug device or an account allowed to send SG_IO style commands, while loading or configuring the debug device itself is usually administrative. The issue is not network reachable. Impact is at least local denial of service via kernel crash, and in the paranoid interpretation may include limited confidentiality or integrity impact because the failure mode is an OOB write rather than a pure NULL dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.