VDB
CVE-2026-2492
CVE-2026-2492
PUBLISHED
block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.
EPSS 0.25% · 16.6th percentile
Risk Scores
EPSS Score
0.25%
16.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| linux | linux_kernel | 4.8, 4.8, 4.8 |
| Linux | Linux | 0, 5.10.251, 5.15.201 |
| n/a | n/a | n/a |
Timeline
- Feb 28, 2013 CVE Published
- Oct 17, 2025 PoC Published
- Oct 21, 2025 PoC Published
- Dec 18, 2025 PoC Published
- Dec 19, 2025 PoC Published
- Dec 26, 2025 PoC Published
- Dec 29, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Dec 30, 2025 PoC Published
- Jan 7, 2026 PoC Published
- Feb 21, 2026 EPSS Score
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23216 advisory
- https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b url
- https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49 url
- https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8 url
- https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05 url
- https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32 url
- https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a url
- https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853 url
- https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62 url
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2492 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40082 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71229 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71235 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23228 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-22998 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27571 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-71232 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23222 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23212 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23220 advisory
…and 21 more