HIGH Introduced in 7.1
scsi BsgSense OOB
CVE-2026-90010
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.
02KernelScan AI Analysis
Risk summary
A local user with access to a SCSI BSG device via io_uring can overrun a user-provided response buffer when sense data is copied back, corrupting adjacent user memory. The bug requires a SCSI device exposing a BSG node and is triggered by a check-condition response.
Vulnerability analysis
When a SCSI command completes with a check condition, the io_uring BSG completion path copies sense data into the user-supplied response buffer using the actual sense length (up to the kernel's sense buffer size) instead of the smaller buffer size the user declared. This overwrites memory beyond the end of the user buffer. The fix stores the user-declared maximum response length and caps the sense copy to that value, so completion never writes past the buffer the caller provided. The vulnerable path is reached by submitting a SCSI passthrough command through io_uring on a BSG device node, which requires access to the corresponding /dev/bsg/* node and is typically gated by device permissions or capabilities.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.5 | 5d326efc334e |
| mainline | 7.1 | 7.3-rc2 | ece06de72673 |