CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg

Synopsis

A length-calculation error in the Linux kernel's scatterlist library (lib/scatterlist, function extract_kvec_to_sg) allows a remote, unauthenticated attacker to exploit an out-of-bounds memory condition over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the service is reachable directly over the network with no credentials or user interaction required. Successful exploitation gives an attacker full read, write, and crash capability against the affected system. Patched-image rebuilds at versions 6.6.140 and 6.12.88 (and the corresponding upstream commit refs) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS vector specifies AV:N, meaning an attacker must be able to reach the vulnerable service over the network; no local or physical access is assumed.

• AuthenticationNot required

  PR:N indicates no credentials of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  UI:N means the attacker does not rely on any action by a logged-in user or administrator to complete the exploit.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing cryptographic keys, session tokens, and sensitive data held in kernel buffers.
• A successful attacker writes to kernel memory, allowing modification of kernel data structures, privilege escalation, or injection of attacker-controlled content into kernel operations.
• A successful attacker crashes the affected kernel, taking down all services and workloads running on the host.