CVE-2026-53304: Linux Kernel SCSI SG DOS Vulnerability

CVE-2026-53304 Overview

CVE-2026-53304 is a Linux kernel vulnerability in the SCSI generic (sg) driver. The flaw allows a privileged local user to trigger a soft lockup by writing an invalid value to the def_reserved_size module parameter and then opening /dev/sgX. The sg_proc_write_dressz function enforces bounds on the reserved buffer size, but the module parameter interface at /sys/module/sg/parameters/def_reserved_size bypasses that validation. Opening the device afterward causes sg_build_reserve to loop while attempting to allocate an impossibly large buffer, stalling the CPU.

Critical Impact
A local root user can induce a CPU soft lockup on affected Linux systems by bypassing input validation on the sg driver's def_reserved_size parameter, resulting in denial of service.

Affected Products

Linux kernel SCSI generic (sg) driver
Kernel versions including 6.19.0-rc3 as referenced in the report
Stable branches receiving backport commits 1afd963, 3d74e06, 9676ca7, c47ccfb, c5f4a21, d06a310, fe671d3, and feade29

Discovery Timeline

2026-06-26 - CVE-2026-53304 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53304

Vulnerability Analysis

The sg driver exposes def_reserved_size to control the default reserved buffer size for each Sg_fd structure. According to the SCSI-Generic HOWTO, this value must fall between 0 and 1,048,576 bytes. The driver's sg_proc_write_dressz handler validates writes through the /proc interface, but the same parameter is also exposed through the kernel's module parameter sysfs path without equivalent validation.

When a user with root privileges writes -1 to /sys/module/sg/parameters/def_reserved_size, the value is interpreted as an unsigned integer of 0xFFFFFFFF. Subsequently opening /dev/sg0 invokes sg_open, which calls sg_add_sfp and then sg_build_reserve. The reserve builder attempts to allocate the oversized buffer in a retry loop, blocking the CPU long enough to trigger the kernel watchdog soft lockup detector.

Root Cause

The root cause is inconsistent input validation between two administrative interfaces controlling the same parameter. The sg driver relied on sg_proc_write_dressz for bounds checking but left the underlying module_param declaration without a validator. The fix replaces the plain module_param registration with module_param_cb, providing a callback that rejects values outside the valid range regardless of the interface used [CWE-20].

Attack Vector

Exploitation requires local access with sufficient privileges to write to /sys/module/sg/parameters/def_reserved_size, typically root. After the parameter is poisoned, any process opening a SCSI generic device such as /dev/sg0 triggers the soft lockup path. The observed call chain proceeds through sg_open → sg_add_sfp → sg_build_reserve, stalling the executing CPU. The impact is denial of service rather than code execution or privilege escalation.

See the upstream stable commits referenced in Kernel Commit Overview 1afd963 and Kernel Commit Overview feade29 for the patch implementation.

Detection Methods for CVE-2026-53304

Indicators of Compromise

Kernel log entries reporting watchdog: BUG: soft lockup - CPU#X stuck for N seconds! with call traces containing sg_build_reserve, sg_add_sfp, and sg_open.
Unexpected writes to /sys/module/sg/parameters/def_reserved_size containing values outside the range 0 to 1,048,576.
Processes opening /dev/sg* devices immediately after modifications to sg module parameters.

Detection Strategies

Monitor dmesg and /var/log/kern.log for soft lockup messages that reference sg_build_reserve in the stack trace.
Audit sysfs writes under /sys/module/sg/parameters/ using auditd rules to detect unauthorized parameter tampering.
Correlate elevated CPU stalls on hosts that expose SCSI generic devices with recent module parameter changes.

Monitoring Recommendations

Deploy audit rules such as -w /sys/module/sg/parameters/def_reserved_size -p wa -k sg_param_tamper to log every write attempt.
Alert on kernel watchdog soft lockup events, especially those referencing the sg driver call stack.
Track root-owned processes that both modify sg module parameters and open /dev/sg* within a short time window.

How to Mitigate CVE-2026-53304

Immediate Actions Required

Apply the stable kernel updates that introduce the module_param_cb validation for def_reserved_size.
Restrict root access on systems exposing SCSI generic devices, since the attack requires the ability to write kernel module parameters.
Remove or blacklist the sg module on hosts that do not require SCSI generic pass-through functionality.

Patch Information

The upstream fix converts the def_reserved_size module parameter to use module_param_cb, adding a setter callback that validates the value falls within 0 to 1,048,576 before accepting it. Backports are available in the stable kernel commits listed in the references, including 1afd963, 3d74e06, 9676ca7, c47ccfb, c5f4a21, d06a310, fe671d3, and feade29.

Workarounds

Blacklist the sg module by adding blacklist sg to /etc/modprobe.d/ on systems that do not require SCSI generic access.
Apply strict file permissions on /sys/module/sg/parameters/def_reserved_size to prevent modification by any account other than the intended administrator.
Use Mandatory Access Control policies such as SELinux or AppArmor to deny writes to sg module parameters from untrusted contexts.

bash

# Blacklist the sg module to prevent load and parameter exposure
echo 'blacklist sg' | sudo tee /etc/modprobe.d/blacklist-sg.conf
sudo rmmod sg 2>/dev/null

# Verify current def_reserved_size value if sg remains loaded
cat /sys/module/sg/parameters/def_reserved_size