Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-46149

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

CVSS 7.1 HighEPSS 0.0014 · 3rd percentile

Published by the CVE Program (CNA: Linux) at 28 May 2026, 09:36 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before d3cc9d490c207d57a289054397349f6f8c90354e git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before db0a4759d62cad4ff891e2d81ae4be73bb57f4a4 git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before 12f2201a56957ba020392223a7393a5eba080c1b git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before 1f678d13e939f91840cb1ebe9b88544923539d3c git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before 72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before 00d91bfdce5033f5d9b4915638ae9b0553848b5d git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before e501154f9d82c95d2719bcbbaf679d8fd3226ef7 git
  • affected c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 to before 772a896a56e0e3ef9424a025cec9176f9d8f4552 git
Other versions: unaffected
Linux Linux
  • affected 2.6.38
  • unaffected before 2.6.38 semver
  • unaffected 5.10.258 to 5.10.*, inclusive semver
  • unaffected 5.15.209 to 5.15.*, inclusive semver
  • unaffected 6.1.175 to 6.1.*, inclusive semver
  • unaffected 6.6.140 to 6.6.*, inclusive semver
  • unaffected 6.12.88 to 6.12.*, inclusive semver
  • unaffected 6.18.30 to 6.18.*, inclusive semver
  • unaffected 7.0.7 to 7.0.*, inclusive semver
  • unaffected 7.1 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-46149
CNA
Linux
Weakness (CWE)
CWE-126
Tags
Published
28 May 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.1 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0014, the 3rd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 28 May 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.