Linux Kernel CVE-2026-74470

Three specific conditions must simultaneously be present for exploitation: (1) the target kernel must be a 32-bit build where size_t is 4 bytes - 64-bit kernels are not affected because the arithmetic does not overflow in a 64-bit size_t context; (2) the scsi_debug kernel module must be loaded - this is a SCSI device emulator used exclusively for kernel testing and is NOT loaded by default in any standard Linux distribution (Debian, RHEL, Ubuntu, SUSE, etc.); and (3) the attacker must have local access sufficient to open the scsi_debug device and submit SCSI commands, which corresponds to CVSS PR:L. Exploitation is blocked in all standard production Linux deployments because the scsi_debug module is absent by default and 32-bit kernel deployments are a vanishing minority. The crafted alloc_len must fall specifically in 0xFFFFFFC1-0xFFFFFFFF; values outside this range do not trigger the overflow. Remote and unauthenticated exploitation is not possible.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a serious local attack with high impact across all three pillars, and the official low-complexity rating suggests the exploit is mechanically straightforward once preconditions are met. However, real-world risk is substantially narrowed by the requirement for both 32-bit kernel architecture and the scsi_debug module being loaded - neither of which applies to the vast majority of modern production Linux deployments. The EPSS score of 0.17% at the 6th percentile is consistent with this narrow attack surface and confirms that exploit activity has not been observed. There is no CISA KEV listing and no known public POC. Even a mid-sized municipal IT team in olsztyn running a heterogeneous Linux fleet should treat this as low urgency unless they can confirm 32-bit kernel deployments with scsi_debug loaded, which would be an atypical configuration. The CVSS AC:L designation somewhat overstates real-world exploitability: the 32-bit architecture constraint is a prerequisite condition that dramatically limits the affected population, an inconsistency worth flagging when triaging this finding. SSVC framing: exploitation status is none, automatability is low (preconditions must be confirmed per target), and technical impact is total on vulnerable hosts - resulting in a deferred/track posture for most organizations.

An attacker with a local shell on a 32-bit Linux system where the scsi_debug module is loaded opens the scsi_debug virtual SCSI device and issues a REPORT ZONES command with an alloc_len field set to a value in the range 0xFFFFFFC1-0xFFFFFFFF. The kernel's resp_report_zones() function overflows during buffer size computation, allocates a zero-byte buffer, and proceeds to write zone descriptor data into unallocated kernel memory - corrupting heap structures in a manner potentially usable for local privilege escalation to root or causing an immediate kernel panic. No public proof-of-concept exploit code is known at time of analysis.