CVE-2025-71065 PUBLISHED

block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

EPSS 0.03% · 7.2th percentile

Risk Scores

EPSS Score
0.03%
7.2th percentile

Affected Products

VendorProductVersions
linuxlinux_kernel2.6.19, 2.6.19, 2.6.19
LinuxLinux2.6.19, 0, 5.10.248
n/an/an/a

Timeline

References

…and 8 more

Open in Interactive Console →