ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-98232

scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

Published Oct 6, 2026 · catalog updated Oct 15, 2026 · scsi: core: Validate MODE

Check if you run it

No confirmed exploitation is on record for CVE-2026-98232. EPSS is 0.18%. Act only if a listed version of scsi: core: Validate MODE is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (scsi: core: Validate MODE).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.18%
Remediation
Advisory link
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel6.5.0 → 6.6.158

How to fix CVE-2026-98232

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-98232. EPSS is 0.18%. Act only if a listed version of scsi: core: Validate MODE is installed.

Which versions are affected?

Compare what you have installed with Kernel 6.5.0 → 6.6.158. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.18%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 6, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can

  2. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.6.158

  3. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.6.158

  4. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.