CVE-2025-39998

What it actually does

Buffer overflow in target_lu_gp_members_show due to snprintf return value exceeding the 256-byte LU_GROUP_NAME_BUF allocation, leading to unsafe memcpy that can corrupt kernel memory.

Why it matters to the business

Kernel memory corruption on systems using the SCSI target subsystem with long HBA or device names in configfs can cause crashes, denial of service, or potential local privilege escalation affecting storage virtualization and container environments.

How an attack unfolds

An attacker with access to configure SCSI target objects via configfs creates an HBA and device whose combined names plus separators exceed 256 bytes; when the show function is invoked, snprintf reports a length that triggers memcpy beyond the buffer, corrupting adjacent kernel structures.

How to fix it

Update to a kernel containing commit e6eeee5dc0d9221ff96d1b229b1d0222c8871b84 or apply the equivalent SUSE kgraft-patch-SLE12_Update_28 (7-2.1) or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the length check after snprintf in target_core_configfs.c and verify that LU_GROUP_NAME_BUF usage no longer permits overflow; test with maximum-length HBA/device names.

Typical attack path

1. Obtain local access or container privileges allowing configfs writes to target_core
2. Create or rename an HBA group and device group with names whose combined length exceeds the safe limit
3. Trigger target_lu_gp_members_show (via sysfs read or related operation)
4. Exploit resulting kernel memory corruption for crash or code execution

How to detect it

Review kernel logs for buffer overflow reports or memcpy warnings triggered during configfs operations on target_core; inspect audit logs for unusual configfs writes creating long HBA or device names.

What your security team should do

• Prioritize patching kernel packages on all systems exposing the SCSI target subsystem
• Restrict untrusted local users and containers from writing to /sys/kernel/config/target
• Monitor for upcoming stable kernel releases and backports from the listed git commit