Database/Kernel, userspace & hypervisor
Linux kernel scsi/ses: out-of-bounds desc_ptr accesses while parsing enclosure data
Impact
ses_enclosure_data_process() could walk desc_ptr past the end of the buffer returned by a SCSI enclosure, giving out-of-bounds reads and possible memory corruption in kernel context. This touches the enclosure-services path that storage shelves and JBOD backplanes in dense GPU and HPC racks expose, so a machine with no SES-capable enclosure never runs the code. Where it does run, the data being parsed comes from the enclosure firmware rather than from a tenant, so the practical exposure is a local user or a compromised enclosure provoking a kernel crash; the record gives no evidence of a remote or cross-tenant path.
Who can reach it
Local, per the CVSS vector (AV:L, PR:L) - a user able to drive SES queries on a host with an attached SCSI enclosure. Not reachable from a GPU pod on a node without enclosure hardware.
What to do
Pick up a stable kernel containing the fix (commits listed in the record, e.g. 414418abc19f) from your distribution and reboot each affected storage or head node. The fix is kernel-resident, so there is no hot-patch path short of a vendor livepatch; drain and reboot in your normal kernel maintenance window rather than scheduling an emergency one, given the local-only exposure.
References
Related entries
- Linux kernel arm64: negative length in IP checksum code causes out-of-bounds readCVE-2023-53726 · Linux kernel arm64 csum (do_csum negative length handling)High
- Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/iommu/iommufd): A tenant supplies an IOVA and user pointer whose alignment math overflows, soCVE-2024-47719 · Linux kernel (drivers/iommu/iommufd)High
- Linux kernel (ALSA usb-audio): Out-of-bounds read finding clock sourcesCVE-2024-53150 · Linux kernel (ALSA usb-audio)High
- VMware ESXi / Workstation / Fusion: Out-of-bounds read in HGFS leaks vmx process memory to the guestCVE-2025-22226 · VMware ESXi / Workstation / FusionHigh
- Linux kernel arm64: MOPS exception handler reads a source register for SET*, going out of bounds on XZRCVE-2025-37846 · Linux kernel arm64 MOPS exception handler (do_el0_mops source register read)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.