CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157

The Linux kernel contains a vulnerability in the scsi: bsg component where a buffer overflow occurs during UFS ARPMB command processing. The bsg-lib allocates a 96-byte buffer based on SCSI_SENSE_BUFFERSIZE, but the struct ufs_rpmb_reply requires 104 bytes (a 40-byte header followed by a 64-byte ...

CVE-2026-99157 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009

CVE-2026-90009 is a TOCTOU (time-of-check to time-of-use) race condition in the Linux kernel's scsi: bsg subsystem, specifically in scsi_bsg_uring_cmd() during io_uring passthrough command setup. The function reads bsg_uring_cmd fields from a shared mmap'd SQE; a local attacker with low privilege...

PT-2026-93651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi bsg component where the completion process copies scmd-sense len to the user response buffer without respecting the max response len limit. Following a valid...

PT-2026-93650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the scsi bsg uring cmd function. The function reads bsg uring cmd from a shared memory-mapped Submission Queue Entry SQE. A user can...

CVE-2026-90009: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

Linux Distros Unpatched Vulnerability : CVE-2026-90010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the...