HIGH Introduced in 7.1
scsi BsgUring Overflow
CVE-2026-90009
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user(). READ_ONCE() the SQE fields we check or use into locals before use.
02KernelScan AI Analysis
Risk summary
A local attacker with access to a SCSI BSG device can exploit a race condition in the io_uring passthrough command handler to overflow a kernel buffer, potentially achieving arbitrary kernel read/write and code execution. The bug requires winning a narrow timing window between a bounds check and a subsequent copy operation. Systems with SCSI devices and local user access are at risk.
Vulnerability analysis
The SCSI BSG io_uring passthrough handler reads command parameters from a memory-mapped submission queue entry that userspace can modify concurrently. A userspace thread can change a length field after the kernel checks it but before the kernel copies data, causing the copy to overflow a fixed-size kernel command buffer. The fix reads all fields from the shared queue entry into local kernel variables before any validation or use, preventing userspace from altering values between the check and the use. The vulnerable path is reachable locally by any process that can open a BSG device file descriptor and submit io_uring commands through it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.5 | f033530105aa |
| mainline | 7.1 | 7.3 | 4b3c5965fca9 |