Linux kernel SCSI core: uninitialized kernel heap bytes are DMA'd out as DMA pad on unaligned transfers

Impact

When the last scatterlist element of a request is unaligned, the SCSI core extends it by pad_len bytes that were never initialized, and those bytes are handed to dma_map_sg() and sent to the device. Kernel heap contents therefore leak out of the host to storage hardware or media - on a shared node that is an information disclosure with no crash to make it visible, and KMSAN flags it as uninit-value in __dma_map_sg_attrs(). Reaching it needs the SG_IO ioctl on a SCSI or ATA device node, so the practical attacker is a local user or container holding such a device, not a remote one. Found with Syzkaller by the Linux Verification Center.

Who can reach it

Local user or container with access to a SCSI/ATA device node that accepts SG_IO (in the report, a /dev/sr CD device). Privileges are whatever your node grants over raw SCSI devices - typically root or the disk group, not an ordinary tenant.

What to do

Apply the stable kernel update that extends last_sg->length and zeroes the pad with sg_zero_buffer() (four stable commits linked) and reboot each node on the next kernel maintenance pass. Removing SG_IO-capable device nodes from untrusted containers closes the path without a reboot. No fixed release numbers are given in the record.

References

Related entries

• Linux kernel sched_ext: BUG_ON panic when a DSQ is destroyed before a deferred re-enqueue runsCVE-2026-89516 · Linux kernel sched_ext (process_deferred_reenq_users BUG_ON on a destroyed DSQ)Unscored
• Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lockCVE-2026-89517 · Linux kernel sched_ext (rq->core_pick and the keep-previous-task decision under core scheduling)Unscored
• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored
• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored
• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored
• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored