CVE-2026-74470

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write issue exists in the scsi debug component of the Linux kernel. The resp report zones() function calculates the reply buffer size based on the CDB allocation length. When alloc len is between 0xFFFFFFC1 and 0xFFFFFFFF, the ALIGN() function rounds the value up to 0x100000000, resulting in an arr len of 4 GB. On 32-bit systems, the kzalloc() function's size t is 32-bit, which truncates 0x100000000 to 0. This causes kzalloc(0) to return ZERO SIZE PTR, which bypasses the null pointer check. Subsequently, the loop dereferences desc = arr + 64, leading to an out-of-bounds write or a system panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.