CVE-2026-53304

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Resolve soft lockup issue when opening /dev/sgX

The parameter def_reserved_size defines the default buffer size reserved

for each Sg_fd and should be restricted to a range between 0 and 1,048,576

(see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the

function sg_proc_write_dressz enforces this limit, it is possible to bypass

it by directly modifying the module parameter as shown below, which then

causes a soft lockup:

echo -1 > /sys/module/sg/parameters/def_reserved_size

exec 4<> /dev/sg0

watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537]

Modules loaded:

CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134,

PREEMPT disabled

Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version

1.16.1-2.fc37 dated 04/01/2014

...

Call Trace:

sg_build_reserve+0x5c/0xa0

sg_add_sfp+0x168/0x270

sg_open+0x16e/0x340

chrdev_open+0xbe/0x230

do_dentry_open+0x175

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References