CVE-2026-89515 Overview
CVE-2026-89515 is a Linux kernel vulnerability in the SCSI core subsystem. The flaw resides in scsi_alloc_sgtables(), where Direct Memory Access (DMA) padding bytes appended to the last unaligned scatterlist element remain uninitialized. Fuzz testing with KMSAN and Syzkaller through the Linux Verification Center exposed the issue via the sg_io ioctl path. When the SCSI layer pads the final scatterlist entry by pad_len bytes to satisfy DMA alignment, those bytes are never zeroed before being mapped for DMA. This constitutes an uninitialized memory use [CWE-908] that can leak kernel heap contents to devices or downstream consumers.
Critical Impact
Uninitialized kernel memory bytes are exposed through padded DMA scatterlist entries during SCSI command execution, creating a potential information disclosure channel to storage hardware and user-issued SG_IO requests.
Affected Products
- Linux kernel SCSI core subsystem (drivers/scsi/scsi_lib.c)
- Kernel branches referenced by the fix commits 1aa6df6, 28ed534, 6261477, 6da140e, 6fd1cce, a4353ec, e7143c3, and fd2cbe0
- Systems exposing SCSI generic (sg) and SCSI CD-ROM (sr) block devices to user space
Discovery Timeline
- 2026-09-11 - CVE-2026-89515 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89515
Vulnerability Analysis
The defect surfaces along the sg_io() → scsi_ioctl() → scsi_queue_rq() → __ata_scsi_queuecmd() → ata_qc_issue() → dma_map_sg_attrs() call chain. Pages allocated by blk_rq_map_user_iov() are handed to the SCSI layer as a scatterlist. When the SCSI core detects that the last element is not DMA-aligned, it extends that element by pad_len bytes so the underlying controller can perform aligned transfers.
Before the fix, scsi_alloc_sgtables() extended the length field without initializing the newly covered bytes. KMSAN reported the resulting uninit-value in __dma_map_sg_attrs+0x217/0x310 with the note that bytes 14-15 of a 16-byte access were uninitialized. The uninitialized region originates from freshly allocated pages that may contain residual kernel data. Any device driver, DMA-visible peripheral, or user process that observes the returned buffer can read stale kernel content.
Root Cause
The SCSI middle layer treated pad_len bytes as an implementation detail of the transport and did not sanitize the tail. The fix extends last_sg->length by pad_len first, then calls sg_zero_buffer() to clear those bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles scatterlist entries that span multiple pages and padding that crosses a page boundary.
Attack Vector
A local user with access to a SCSI generic device (for example /dev/sr0) can issue crafted SG_IO requests whose payload lengths force pad_len to be non-zero. The uninitialized tail is then DMA-mapped and, depending on the transport, may be echoed back or observed on the bus. Because the trigger requires the ability to submit block ioctls, exploitation is bounded by the permissions on the underlying block device.
No public proof-of-concept exploit has been released. The issue was found by the Linux Verification Center at linuxtesting.org using Syzkaller.
Detection Methods for CVE-2026-89515
Indicators of Compromise
- KMSAN reports referencing __dma_map_sg_attrs and originating from scsi_alloc_sgtables() on debug kernels.
- Anomalous volumes of SG_IO ioctls issued against /dev/sr* or /dev/sg* from non-administrative accounts.
- Unexpected user processes opening SCSI generic block devices outside of backup, imaging, or media workflows.
Detection Strategies
- Audit kernel versions across Linux fleets against the patched commits listed in the kernel.org references to identify unpatched hosts.
- Enable syscall auditing for ioctl on SCSI block device paths and correlate on user, process image, and request length.
- On test systems, run KMSAN-instrumented kernels through storage fuzzers to confirm the issue is resolved.
Monitoring Recommendations
- Forward auditd and kernel logs to a centralized analytics pipeline and alert on new processes performing SG_IO operations.
- Track loaded kernel versions and modules through configuration management to flag hosts drifting from the patched baseline.
- Monitor for KMSAN or KASAN backtraces mentioning scsi_alloc_sgtables in kernel ring buffers on canary hosts.
How to Mitigate CVE-2026-89515
Immediate Actions Required
- Apply the stable kernel updates that include the SCSI core fix and reboot affected hosts.
- Restrict access to /dev/sg* and /dev/sr* to trusted service accounts using udev rules and group membership.
- Inventory hosts that expose SCSI generic ioctls to containers or unprivileged users and prioritize them for patching.
Patch Information
The upstream fix modifies scsi_alloc_sgtables() to extend last_sg->length by pad_len and then call sg_zero_buffer() on the padded region. The change is distributed across the stable trees in commits 1aa6df6, 28ed534, 6261477, 6da140e, 6fd1cce, a4353ec, e7143c3, and fd2cbe0. Consume the corresponding stable kernel release from your distribution vendor.
Workarounds
- Remove or restrict the sg and sr_mod modules on systems that do not require SCSI generic access.
- Enforce least privilege on block device nodes so only vetted service accounts can invoke SG_IO.
- Isolate workloads that require raw SCSI ioctls into dedicated hosts or virtual machines pending patch deployment.
# Configuration example: restrict SCSI generic device access via udev
# /etc/udev/rules.d/60-scsi-generic.rules
KERNEL=="sg[0-9]*", MODE="0600", OWNER="root", GROUP="root"
KERNEL=="sr[0-9]*", MODE="0640", OWNER="root", GROUP="cdrom"
# Reload udev and reapply rules
sudo udevadm control --reload-rules
sudo udevadm trigger
# Optionally blacklist the sg module where unused
echo "blacklist sg" | sudo tee /etc/modprobe.d/blacklist-sg.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
