What is the CVSS score of EUVD-2026-59663?

EUVD-2026-59663 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59663?

A Linux kernel vulnerability in the scsi_debug module enables local privilege escalation, allowing low-privileged attackers to gain system-level control.. A patch is available.

How to fix or mitigate EUVD-2026-59663?

Within 24 hours, identify all systems with the Linux kernel scsi_debug module enabled, prioritizing 32-bit systems. Within 7 days, apply the available Linux kernel patch to affected systems per vendor advisory. Within 30 days, complete deployment verification and confirm all systems are running the patched kernel version.

Linux Kernel EUVD-2026-59663

| CVE-2026-74470 HIGH

2026-08-15 Linux

GHSA-jmr9-wc6r-pj32

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

32-bit kernel architecture and loaded scsi_debug module are non-default preconditions warranting AC:H; local low-privilege access confirmed by PR:L; all three impact dimensions high due to kernel heap corruption potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:37 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count:

rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);

For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic.

Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.

AnalysisAI

Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local low-privilege shell access

Delivery

Confirm 32-bit kernel and scsi_debug loaded

Exploit

Open scsi_debug virtual SCSI device

Install

Send REPORT ZONES with alloc_len in 0xFFFFFFC1-0xFFFFFFFF

ALIGN() overflows to 0x100000000, truncates to zero

Execute

kzalloc(0) returns ZERO_SIZE_PTR, bypasses null check

Impact

OOB write corrupts kernel heap, escalate to root or crash

Recon

Gain local low-privilege shell access

Delivery

Confirm 32-bit kernel and scsi_debug loaded

Exploit

Open scsi_debug virtual SCSI device

Install

Send REPORT ZONES with alloc_len in 0xFFFFFFC1-0xFFFFFFFF

ALIGN() overflows to 0x100000000, truncates to zero

Execute

kzalloc(0) returns ZERO_SIZE_PTR, bypasses null check

Impact

OOB write corrupts kernel heap, escalate to root or crash

Vulnerability AssessmentAI

Exploitation	Three specific conditions must simultaneously be present for exploitation: (1) the target kernel must be a 32-bit build where size_t is 4 bytes - 64-bit kernels are not affected because the arithmetic does not overflow in a 64-bit size_t context; (2) the scsi_debug kernel module must be loaded - this is a SCSI device emulator used exclusively for kernel testing and is NOT loaded by default in any standard Linux distribution (Debian, RHEL, Ubuntu, SUSE, etc.); and (3) the attacker must have local access sufficient to open the scsi_debug device and submit SCSI commands, which corresponds to CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a serious local attack with high impact across all three pillars, and the official low-complexity rating suggests the exploit is mechanically straightforward once preconditions are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a local shell on a 32-bit Linux system where the scsi_debug module is loaded opens the scsi_debug virtual SCSI device and issues a REPORT ZONES command with an alloc_len field set to a value in the range 0xFFFFFFC1-0xFFFFFFFF. The kernel's resp_report_zones() function overflows during buffer size computation, allocates a zero-byte buffer, and proceeds to write zone descriptor data into unallocated kernel memory - corrupting heap structures in a manner potentially usable for local privilege escalation to root or causing an immediate kernel panic. …
Remediation	The primary fix is to upgrade to a patched Linux kernel stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems with the Linux kernel scsi_debug module enabled, prioritizing 32-bit systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59663 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59663

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code