{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  scsi: sg: Resolve soft lockup issue when opening /dev/sgX  The parameter def_reserved_size defines the default buffer size reserved for each Sg_fd and should be restricted to a range between 0 and 1,048,576 (see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html).  Although the function sg_proc_write_dressz enforces this limit, it is possible to bypass it by directly modifying the module parameter as shown below, which then causes a soft lockup:  echo -1 \u003e /sys/module/sg/parameters/def_reserved_size exec 4\u003c\u003e /dev/sg0  watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537] Modules loaded: CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134, PREEMPT disabled Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version 1.16.1-2.fc37 dated 04/01/2014 ... Call Trace:    sg_build_reserve+0x5c/0xa0   sg_add_sfp+0x168/0x270   sg_open+0x16e/0x340   chrdev_open+0xbe/0x230   do_dentry_open+0x175/0x480   vfs_open+0x34/0xf0   do_open+0x265/0x3d0   path_openat+0x110/0x290   do_filp_open+0xc3/0x170   do_sys_openat2+0x71/0xe0   __x64_sys_openat+0x6d/0xa0   do_syscall_64+0x62/0x310   entry_SYSCALL_64_after_hwframe+0x76/0x7e  The fix is to use module_param_cb to validate and reject invalid values assigned to def_reserved_size.",
  "id": "DEBIAN-CVE-2026-53304",
  "modified": "2026-09-14T16:47:30.673660836Z",
  "published": "2026-06-26T20:17:23.637Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53304"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53304"
  ]
}