Linux kernel SCSI core: unvalidated MODE SENSE lengths leak stack memory to the storage device

Impact

scsi_cdl_enable() trusts the length fields a target returns from MODE SENSE when locating the ATA feature page in a 64-byte stack buffer. A target that reports a total length shorter than its own mode header and block descriptors makes the unsigned subtraction wrap and buf_data point past the buffer, so the kernel clears bits in a device-chosen out-of-bounds stack byte and then copies up to 64 bytes of adjacent kernel stack into the outgoing MODE SELECT payload - handing stack contents, including pointers useful for defeating KASLR, to whatever is on the other end of the bus. The path runs during automatic enumeration: no mount and no userspace access to the block device is required. The reporter demonstrated it with a Raw Gadget USB device that claims to be an ATA device advertising CDL support.

Who can reach it

Requires a malicious or emulated storage device to be attached and enumerated - physical USB access to the node, or control of virtual media presented to the host, for example a mapped USB/CD image over the BMC's Redfish or KVM interface. No host authentication and no logged-in user are needed once the device is attached.

What to do

Take the stable kernel update that caps the available length to the buffer size and validates the mode header and block descriptor lengths, then drain and reboot each node. Until then, treat BMC virtual-media mapping as a privileged operation and keep the management VLAN closed, and keep physical USB ports on production nodes disabled or restricted. The record names only the stable commits, not a fixed release version.

References

Related entries

• Linux kernel dma-buf: 32-bit mapped_len truncates peer-to-peer DMA mappings larger than 4 GiBCVE-2026-98242 · Linux kernel dma-buf (phys vec to scatterlist conversion, mapped_len overflow)Unscored
• Linux kernel dma-fence: lost RCU protection after signalling allows use-after-free of fence name stringsCVE-2026-98243 · Linux kernel dma-buf/dma-fence (timeline and driver name accessors)Unscored
• Linux kernel arm64: LSE percpu ops on 8/16-bit types read and write 32 bits of memoryCVE-2026-98248 · Linux kernel arm64 percpu operations (LSE atomics on 8- and 16-bit types)Unscored
• Linux kernel RDMA/core: iWARP port mapper initialises its refcount after publishing the requestCVE-2026-98252 · Linux kernel RDMA/core iWARP port mapper (iwpm_get_nlmsg_request refcount init)Unscored
• Linux kernel perf: NULL pmu dereference when a PMU module unloads with an event openCVE-2026-98268 · Linux kernel perf (is_include_guest_event / mediated PMU accounting)Unscored
• Linux kernel x86/kprobes: wrong return address when probing a CS-prefixed CALL crashes the hostCVE-2026-98273 · Linux kernel x86/kprobes (int3_emulate_call instruction length)Unscored