Skip to main content

Linux Kernel CVE-2026-53304

| EUVDEUVD-2026-39839 MEDIUM
Improper Locking (CWE-667)
2026-06-26 Linux GHSA-cx67-j66h-cm23
Authentication Bypass Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Writing sysfs module parameters typically requires root/CAP_SYS_ADMIN, so PR:H is more accurate than the provided PR:L; impact is availability-only with no scope change.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:58 vuln.today
CVSS changed
Jul 06, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Resolve soft lockup issue when opening /dev/sgX

The parameter def_reserved_size defines the default buffer size reserved for each Sg_fd and should be restricted to a range between 0 and 1,048,576 (see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the function sg_proc_write_dressz enforces this limit, it is possible to bypass it by directly modifying the module parameter as shown below, which then causes a soft lockup:

echo -1 > /sys/module/sg/parameters/def_reserved_size exec 4<> /dev/sg0

watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537] Modules loaded: CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134, PREEMPT disabled Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version 1.16.1-2.fc37 dated 04/01/2014 ... Call Trace:

sg_build_reserve+0x5c/0xa0 sg_add_sfp+0x168/0x270 sg_open+0x16e/0x340 chrdev_open+0xbe/0x230 do_dentry_open+0x175/0x480 vfs_open+0x34/0xf0 do_open+0x265/0x3d0 path_openat+0x110/0x290 do_filp_open+0xc3/0x170 do_sys_openat2+0x71/0xe0 __x64_sys_openat+0x6d/0xa0 do_syscall_64+0x62/0x310 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The fix is to use module_param_cb to validate and reject invalid values assigned to def_reserved_size.

AnalysisAI

Soft CPU lockup in the Linux kernel SCSI generic (sg) driver allows a local user to trigger a denial of service by writing an out-of-range value directly to the def_reserved_size sysfs module parameter, bypassing the validation enforced by sg_proc_write_dressz. Setting def_reserved_size to -1 via /sys/module/sg/parameters/def_reserved_size causes sg_build_reserve to enter a non-terminating allocation loop on the next open() of any /dev/sgX device, hanging the affected CPU core for 26+ seconds until the kernel watchdog fires. No public exploit code has been identified and EPSS probability is very low at 0.18%; patches are confirmed available across all active stable kernel branches.

Technical ContextAI

The vulnerability resides in the Linux kernel SCSI generic character driver (drivers/scsi/sg.c), identified via CPE cpe:2.3:a:linux:linux. The def_reserved_size module parameter governs the DMA buffer reservation size (valid range: 0-1,048,576 bytes) allocated per sg file descriptor (Sg_fd). The proc-based write path sg_proc_write_dressz correctly validates and rejects out-of-range values, but the sysfs-exposed module parameter path (/sys/module/sg/parameters/def_reserved_size) had no equivalent callback validation. When set to -1, the value wraps to a very large unsigned integer; when any process subsequently calls open() on /dev/sgX, sg_build_reserve loops attempting to satisfy an unachievable allocation, consuming the CPU and triggering the kernel soft lockup watchdog. The root cause class is CWE-667 (Improper Locking / resource management - an unbounded loop that starves the CPU scheduler). The fix replaces module_param with module_param_cb, installing a validation callback that enforces the same range check on the sysfs write path that sg_proc_write_dressz already enforced.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel on the applicable stable branch: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or any later release in those series). Upstream patch commits are available at https://git.kernel.org/stable/c/3d74e0654ac908c65a8f20373091826fe43b1363 and the additional commits listed in the CVE references. Where immediate kernel upgrade is not feasible, restrict write access to /sys/module/sg/parameters/def_reserved_size using filesystem ACLs or an SELinux/AppArmor policy rule denying writes to that path - this prevents parameter poisoning at the cost of losing runtime tunability of the parameter. If SCSI generic functionality is not required by any workload, blacklisting the sg module (adding 'blacklist sg' to /etc/modprobe.d/) eliminates the attack surface entirely, with the trade-off that SCSI generic device access is unavailable. Auditd rules watching for writes to /sys/module/sg/parameters/ can provide detection coverage on unpatched systems.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53304 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy