CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: s...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157

The Linux kernel contains a vulnerability in the scsi: bsg component where a buffer overflow occurs during UFS ARPMB command processing. The bsg-lib allocates a 96-byte buffer based on SCSI_SENSE_BUFFERSIZE, but the struct ufs_rpmb_reply requires 104 bytes (a 40-byte header followed by a 64-byte ...

CVE-2026-99157 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

EUVD-2026-111909

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

PT-2026-128150

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply len to bsg setup queue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSI SENSE BUFFERSIZE reply buffer per job, but struct ufs rpmb reply is 104 bytes: a 40-byte struct ufs bsg reply followed by a...

CVE-2026-97529: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

PT-2026-98469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi qla2xxx driver where the FC BSG transport allocates job-request using a user-supplied request len via memdup user. For FC BSG HST VENDOR, the fc bsg host...

CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.10 contains a security vulnerability. This vulnerability arises from the qla2xxx driver not verifying the length of the BSG request before reading vendorcmd, which may lead to out-of-bounds heap access...

SUSE CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

SUSE CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

SUSE CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

SUSE CVE-2026-89865

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

DEBIAN-CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

DEBIAN-CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...