CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

Synopsis

A stack buffer over-read vulnerability exists in the Linux kernel's SCSI target configfs subsystem, specifically in the tg_pt_gp_members_show() function. An attacker with a low-privilege local account can trigger the flaw by reading a sysfs attribute when a fabric WWN (such as a long iSCSI IQN name) causes snprintf() to return a value larger than the 256-byte stack buffer, leading to memcpy() reading past the buffer boundary. Successful exploitation exposes adjacent stack memory contents to the sysfs reader and can trigger a kernel panic via CONFIG_FORTIFY_SOURCE, resulting in information disclosure and denial of service. A patched-image rebuild at fix versions 6.6.140 and 6.12.88 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the sysfs read that exposes the vulnerability.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the flaw directly by reading the affected sysfs attribute.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required to trigger the over-read.

Blast Radius

• Reads adjacent kernel stack memory contents and exposes them to an unprivileged sysfs reader, potentially leaking kernel pointers, function addresses, or other sensitive stack data.
• Triggers a kernel panic via CONFIG_FORTIFY_SOURCE when the fortify bounds check detects the out-of-bounds memcpy, crashing the affected host or container runtime.
• Availability of the system is fully disrupted for any workload sharing the kernel, as a panic terminates all running processes on the host.