{"id":21437,"date":"2026-09-12T04:31:11","date_gmt":"2026-09-11T20:31:11","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89515"},"modified":"2026-09-12T04:31:11","modified_gmt":"2026-09-11T20:31:11","slug":"cve-2026-89515","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89515","title":{"rendered":"CVE-2026-89515 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fill in D"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()<\/p>\n<p>During fuzz testing, the following issue was discovered:<\/p>\n<p>BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217\/0x310<br \/>\n __dma_map_sg_attrs+0x217\/0x310<br \/>\n dma_map_sg_attrs+0x4a\/0x70<br \/>\n ata_qc_issue+0x9f8\/0x1420<br \/>\n __ata_scsi_queuecmd+0x1657\/0x1740<br \/>\n ata_scsi_queuecmd+0x79a\/0x920<br \/>\n scsi_queue_rq+0x4472\/0x4f40<br \/>\n blk_mq_dispatch_rq_list+0x1cca\/0x3ee0<br \/>\n __blk_mq_sched_dispatch_requests+0x458\/0x630<br \/>\n blk_mq_sched_dispatch_requests+0x15b\/0x340<br \/>\n __blk_mq_run_hw_queue+0xe5\/0x250<br \/>\n __blk_mq_delay_run_hw_queue+0x138\/0x780<br \/>\n blk_mq_run_hw_queue+0x4bb\/0x7e0<br \/>\n blk_mq_sched_insert_request+0x2a7\/0x4c0<br \/>\n blk_execute_rq+0x497\/0x8a0<br \/>\n sg_io+0xbe0\/0xe20<br \/>\n scsi_ioctl+0x2b36\/0x3c60<br \/>\n sr_block_ioctl+0x319\/0x440<br \/>\n blkdev_ioctl+0x80f\/0xd70<br \/>\n __se_sys_ioctl+0x219\/0x420<br \/>\n __x64_sys_ioctl+0x93\/0xe0<br \/>\n x64_sys_call+0x1d6c\/0x3ad0<br \/>\n do_syscall_64+0x4c\/0xa0<br \/>\n entry_SYSCALL_64_after_hwframe+0x6e\/0xd8<\/p>\n<p>Uninit was created at:<br \/>\n __alloc_pages+0x5c0\/0xc80<br \/>\n alloc_pages+0xe0e\/0x1050<br \/>\n blk_rq_map_user_iov+0x2b77\/0x6100<br \/>\n blk_rq_map_user_io+0x2fa\/0x4d0<br \/>\n sg_io+0xad6\/0xe20<br \/>\n scsi_ioctl+0x2b36\/0x3c60<br \/>\n sr_block_ioctl+0x319\/0x440<br \/>\n blkdev_ioctl+0x80f\/0xd70<br \/>\n __se_sys_ioctl+0x219\/0x420<br \/>\n __x64_sys_ioctl+0x93\/0xe0<br \/>\n x64_sys_call+0x1d6c\/0x3ad0<br \/>\n do_syscall_64+0x4c\/0xa0<br \/>\n entry_SYSCALL_64_after_hwframe+0x6e\/0xd8<\/p>\n<p>Bytes 14-15 of 16 are uninitialized<br \/>\nMemory access of size 16 starts at ffff88800cbdb000<\/p>\n<p>When processing the last unaligned element of the scatterlist, it is<br \/>\nsupplemented with missing bytes in the amount of pad_len.  These bytes<br \/>\nremain uninitialized, which leads to a problem.<\/p>\n<p>Extend last_sg-&gt;length by pad_len first, then use sg_zero_buffer() to<br \/>\nzero those pad_len bytes.  sg_zero_buffer() uses sg_miter internally,<br \/>\nwhich correctly handles sg entries spanning multiple pages and padding<br \/>\nthat crosses a page boundary.<\/p>\n<p>Found by Linux Verification Center (linuxtesting.org) with Syzkaller.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()<\/p>\n<p>During fuzz testing, the following issue was discovered:<\/p>\n<p>BUG: KMSA<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21437","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}