Unknown

CVE-2026-89515 — scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310 __dma_map_sg_attrs+0x217/0x310 dma_map_sg_attrs+0x4a/0x70 ata_qc_issue+0x9f8/0x1420 __ata_scsi_queuecmd+0x1657/0x1740 ata_scsi_queuecmd+0x79a/0x920 scsi_queue_rq+0x4472/0x4f40 blk_mq_dispatch_rq_list+0x1cca/0x3ee0 __blk_mq_sched_dispatch_requests+0x458/0x630 blk_mq_sched_dispatch_requests+0x15b/0x340 __blk_mq_run_hw_queue+0xe5/0x250 __blk_mq_delay_run_hw_queue+0x138/0x780 blk_mq_run_hw_queue+0x4bb/0x7e0 blk_mq_sched_insert_request+0x2a7/0x4c0 blk_execute_rq+0x497/0x8a0 sg_io+0xbe0/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Uninit was created at: __alloc_pages+0x5c0/0xc80 alloc_pages+0xe0e/0x1050 blk_rq_map_user_iov+0x2b77/0x6100 blk_rq_map_user_io+0x2fa/0x4d0 sg_io+0xad6/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem. Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published Sep 11, 2026 · Updated Oct 19, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.18%

ahead of 7% of scored CVEs · Oct 23, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < 1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < 6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < 28ed5343666ff424ce5e248fa1c5a402303b4aff≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < a4353ec7742bdf87dcdde5875270feb3a1982a51≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < e7143c3f4e5c0a7986733c6f27009274bf6c4264≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < 6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409≥ 40b01b9bbdf51ae543a04744283bf2d56c4a6afa and < 626147717bea776b61ed3631d2c26283760c4cc4 and 1 more version 2.6.25	Vulnerable	CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 23, 2026 · 8 reading(s) · max 0.18%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Sep 11, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× References added · Oct 19, 2026 – Oct 19, 2026
1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

10 on the record

github.com/advisories/GHSA-c4r4-q33m-rp34
GitHub Security Advisories
git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff
NIST National Vulnerability Database
git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c
NIST National Vulnerability Database
git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264
NIST National Vulnerability Database
git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51
NIST National Vulnerability Database
git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8
NIST National Vulnerability Database
git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4
NIST National Vulnerability Database
git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409
NIST National Vulnerability Database
git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1
NIST National Vulnerability Database
nvd.nist.gov/vuln/detail/CVE-2026-89515
GitHub Security Advisories

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99086 dm-integrity: validate the superblock on resume 21h
Unknown CVE-2026-99087 dm-integrity: fix NULL pointer dereference when the 'R' flag is used 21h
Unknown CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry 21h
Unknown CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode() 21h
Unknown CVE-2026-99081 bnxt_en: fix DMA mapping length for padded small packets 21h
Unknown CVE-2026-99082 KVM: x86: Use active memslots for the per-vCPU MMIO cache 21h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-89515 is "scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.18% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.