The Linux kernel's sg driver had a vulnerability where the module parameter def_reserved_size, which defines the default buffer size reserved for each Sg_fd, could be set to an invalid value outside the allowed range (0 to 1,048,576). Although the function sg_proc_write_dressz enforces this limit, it can be bypassed by directly writing to the module parameter, leading to a soft lockup when opening /dev/sgX. The kernel hangs due to improper handling of this invalid parameter value. The fix involves using module_param_cb to validate and reject invalid assignments to def_reserved_size, preventing the soft lockup condition.

This vulnerability causes a denial of service condition via a soft lockup in the Linux kernel when opening the SCSI generic device /dev/sgX with an invalid def_reserved_size parameter. It does not impact confidentiality or integrity but results in system unresponsiveness on the affected CPU core. The vulnerability requires local privileges to exploit and does not involve user interaction.

A fix is available that validates and rejects invalid values assigned to the def_reserved_size module parameter using module_param_cb. Users should update their Linux kernel to a version that includes this fix. Until patched, avoid modifying the def_reserved_size parameter directly to values outside the allowed range (0 to 1,048,576).