CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: s...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157

The Linux kernel contains a vulnerability in the scsi: bsg component where a buffer overflow occurs during UFS ARPMB command processing. The bsg-lib allocates a 96-byte buffer based on SCSI_SENSE_BUFFERSIZE, but the struct ufs_rpmb_reply requires 104 bytes (a 40-byte header followed by a 64-byte ...

CVE-2026-99157 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

EUVD-2026-111909

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

PT-2026-128150

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply len to bsg setup queue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSI SENSE BUFFERSIZE reply buffer per job, but struct ufs rpmb reply is 104 bytes: a 40-byte struct ufs bsg reply followed by a...