Summary
A large device-reported SCSI defect list could wrap the allocation calculation while leaving the original logical element count intact, leading to out-of-bounds writes and reads.
Technical analysis
The accompanying research article explains the finding, reproduction, and remediation status.
Read the technical write-upDisclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified