CVE-2026-93433
Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing
What happened?
A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| libstoragemgmtRed Hat | Default status: affected | See vendor advisory |
| libstoragemgmtRed Hat | Default status: affected | See vendor advisory |
| libstoragemgmtRed Hat | Default status: affected | See vendor advisory |
| libstoragemgmtRed Hat | Default status: affected | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.