Cloudanix VulnDB

CVE-2026-98232

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A specially made USB storage drive can trick Linux into sending a small piece of the computer's internal memory back to the drive, which could help an attacker learn more about the system.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An attacker-controlled SCSI target can return a MODE SENSE response with a total length shorter than the header plus block descriptors, causing an unsigned subtraction to wrap and buf_data to point beyond a 64-byte stack buffer in scsi_cdl_enable(). This permits an out-of-bounds read that discloses up to 64 bytes of kernel stack memory via a subsequent MODE SELECT command.

Why it matters to the business

Systems that scan untrusted USB storage devices can leak small amounts of kernel memory to the device, potentially exposing addresses or other data useful for further attacks. The issue is reachable without any filesystem access or user interaction beyond device insertion and carries low exploitation likelihood at present.

How an attack unfolds

An attacker connects a USB device that identifies as an ATA drive advertising CDL support. During automatic kernel enumeration the device returns a crafted short MODE SENSE reply that triggers the length miscalculation and out-of-bounds read inside scsi_cdl_enable(); the kernel then sends the leaked stack bytes back to the device in the MODE SELECT payload.

How to fix it

Apply a kernel update that caps the available length to the buffer size, validates the mode header and block descriptor lengths, and ensures the five bytes required for the CDL field are present before use. The referenced upstream fix is commit cee9395acd80.

How to confirm the fix worked

Confirm the presence of length validation and buffer-size capping logic inside scsi_cdl_enable() after applying the patch; re-test enumeration of a device that returns short MODE SENSE responses.

Typical attack path

  1. Connect malicious USB storage device emulating ATA with CDL support
  2. Kernel begins automatic SCSI scan and issues MODE SENSE
  3. Device returns response with understated total length
  4. Length subtraction wraps and buf_data points outside the stack buffer
  5. Read-modify-write and MODE SELECT disclose stack contents to the device

How to detect it

Inspect kernel logs for SCSI mode-page handling anomalies during USB enumeration and watch for devices that report ATA identity with CDL support; correlate with unexpected MODE SENSE or MODE SELECT traffic from removable devices.

What your security team should do

  • Prioritize kernel updates on systems that may attach untrusted USB storage
  • Consider disabling automatic SCSI device scanning for removable media where operationally feasible
  • Monitor vendor advisories for backported fixes in supported distributions

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field.

Affected packages

Ecosystem Package Introduced Fixed