CVE-2026-53304: Linux Kernel sg Driver Soft Lockup via Invalid Module Parameter

Technical summary

CVE-2026-53304 is a soft lockup vulnerability in the Linux kernel's sg (SCSI Generic) driver. The def_reserved_size module parameter is intended to define the default buffer size per Sg_fd file descriptor, with valid values between 0 and 1,048,576 bytes. While the sg_proc_write_dressz sysctl handler enforces this range, the parameter can be directly modified via /sys/module/sg/parameters/def_reserved_size, bypassing validation. When an out-of-range value (negative or excessively large) is set and a device file under /dev/sgX is subsequently opened, the sg_build_reserve function enters an infinite or near-infinite loop during memory allocation, causing a watchdog-detected CPU lockup. The fix involves implementing proper validation callbacks using module_param_cb to reject invalid values at assignment time rather than relying solely on sysctl enforcement.

Business impact

This vulnerability can disrupt operations on systems that expose SCSI generic device access to unprivileged or semi-trusted local users. On affected systems, an attacker could render a node unresponsive by triggering a soft lockup, causing service interruptions and potential cascading failures in clustered or virtualized environments. Data processing on SCSI devices would be interrupted. Recovery typically requires system restart, resulting in downtime and administrative overhead. The impact is primarily availability-focused and localized to systems where SCSI generic device files are actively used.

Affected systems

The vulnerability affects Linux kernel versions prior to the patch that implements module_param_cb validation for the sg driver's def_reserved_size parameter. Any Linux system with an sg (SCSI Generic) driver compiled as a module or built-in is potentially vulnerable if the kernel version predates the fix. Systems that do not expose /dev/sgX device files to local users or run heavily restricted environments have reduced exposure. Both physical servers and virtual machines running vulnerable Linux kernels are in scope.

Exploitability

Exploitation requires local access to the system and sufficient privileges (typically root or membership in a group with device access). The attack is straightforward: write an invalid value to /sys/module/sg/parameters/def_reserved_size, then attempt to open a SCSI device file. No special tools or advanced techniques are needed. However, the attacker must already have login capability and appropriate user privileges, making this a local privilege escalation or local denial-of-service vector rather than a remote attack. The CVSS score of 5.5 (Medium) reflects the local requirement and absence of confidentiality or integrity impact.

Remediation

Apply a kernel update that includes the fix implementing module_param_cb validation for def_reserved_size. The patch adds input validation at parameter assignment time, preventing out-of-range values from being set via the sysfs interface. Systems should update to a patched kernel version as released by their Linux distribution. Verify against your vendor's advisory for specific patched versions applicable to your kernel branch. Until patched, restrict write access to /sys/module/sg/parameters/def_reserved_size via filesystem permissions and limit who can open /dev/sgX files.

Patch guidance

Obtain and deploy kernel updates from your Linux distribution's vendor. Check your distribution's security advisories for CVE-2026-53304 to identify the specific patched kernel versions. Typical remediation involves updating the kernel package via your package manager (apt, yum, zypper, etc.) and rebooting to activate the fix. For production environments, schedule patching during a maintenance window and test in a staging environment first. Long-term kernel support (LTS) branches should receive patches; verify availability before deploying to production systems.

Detection guidance

Monitor for soft lockup warnings in kernel logs (dmesg, journalctl) mentioning sg_build_reserve or sg-related functions, particularly around device open operations on /dev/sgX. Audit access to /sys/module/sg/parameters/def_reserved_size for unauthorized modification attempts. Check for privilege escalation or container escape scenarios where a local user attempts to set module parameters. Log and alert on repeated failures to open SCSI device files preceded by parameter changes. Use tools like auditd to track modifications to sysfs sg driver parameters.

Why prioritize this

While the CVSS score is Medium (5.5), the vulnerability should be prioritized for systems that (1) actively use SCSI generic device access, (2) run untrusted or semi-trusted local user workloads, or (3) operate in multi-tenant virtualization environments. The ease of exploitation and the severity of impact (complete CPU lockup requiring reboot) warrant timely patching. Organizations with strict local access controls or those not using sg driver features can deprioritize, but general-purpose systems should treat this as a standard-priority patch.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity vulnerability with local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), but high availability impact (A:H). The score appropriately captures that a local user can completely deny service to the system by freezing a CPU, but requires pre-existing local access. The absence of remote exploitability and data compromise limits the score below High, yet the practical impact of a system lockup is severe.

Frequently asked questions