CVE-2026-23072 PUBLISHED

block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

EPSS 0.02% · 3.0th percentile

Risk Scores

EPSS Score
0.02%
3.0th percentile

Affected Products

VendorProductVersions
n/an/an/a
LinuxLinux2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450
linuxlinux_kernel2.6.19, 2.6.19, 2.6.19

Timeline

References

…and 31 more

Open in Interactive Console →