CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check
Vulnerability summary
CVE-2026-53021 is a medium (CVSS 5.5) Integer Overflow or Wraparound vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 49 · Related 49Timeline
- 24-06-2026PublishedVulnerability first disclosed.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_execute_unmap() checks LBA + range does not exceed the device capacity, but does not guard against LBA + range wrapping around on 64-bit overflow. Add an overflow check matching the pattern already used for WRITE_SAME in the same file.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Decrease -0.04 pp
From 0.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu166 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < c08ab702c4699c6efb9d60bdb15b73e7a627ee7e | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 5efc3ef4758f8d98c257419fa21daca3227de61a | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < d7aef29573c7c5cdb2dfad939253287a6329c2a4 | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 3facdecc3fcf115cc4f9b3d8f118d6705e2456a8 | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 51075df70c46e60a9773f2dcd28299e40dac36fb | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 02115986d027ade793e7f6be87e91d6a796d0aa3 | ≥ 86d7182985d25900929adce14fffd729cc8c6fb8, < 2bf2d65f76697820dbc4227d13866293576dd90a | 3.10
- linux_kernel≥ 3.10, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1
3 vendors · 169 products
