The Linux kernel SCSI core had a vulnerability where DMA padding bytes in the last scatterlist element were left uninitialized during scsi_alloc_sgtables(). This was discovered through fuzz testing with KMSAN detecting uninitialized value usage in __dma_map_sg_attrs. The root cause was that the padding bytes (pad_len) added to the last scatterlist element were not zeroed, potentially leading to uninitialized memory exposure. The fix involved extending the last scatterlist length by pad_len and zeroing those bytes using sg_zero_buffer(), which correctly handles scatterlist entries spanning multiple pages and padding crossing page boundaries. This vulnerability was found by the Linux Verification Center using Syzkaller.

The vulnerability involves uninitialized memory usage in the Linux kernel's SCSI subsystem, which could lead to exposure of uninitialized kernel memory. The exact impact is not detailed in the input data, and no active exploits are known. The issue could potentially affect kernel stability or security depending on how the uninitialized data is used.

A fix has been implemented in the Linux kernel to address this issue by zeroing the DMA padding bytes in scsi_alloc_sgtables(). Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the input data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.