Executive brief
The Linux kernel's block storage generic (BSG) driver contains a time-of-check-to-time-of-use (TOCTOU) vulnerability in its io_uring passthrough command handler. An attacker with local access can exploit this race condition to modify shared memory after validation checks complete but before the kernel uses the values, potentially causing a buffer overflow in the SCSI command buffer and leading to privilege escalation or kernel crash.
Technical details
The vulnerability is a classic TOCTOU race condition in the scsi_bsg_uring_cmd() function within drivers/scsi/scsi_bsg.c. The function reads BSG (Block Storage Generic) command structures from a user-space mmap'd io_uring submission queue entry (SQE) without using READ_ONCE() to atomically capture the values. Specifically, the request_len field is validated against sizeof(scmd->cmnd), but a malicious userspace process can change this field after the bounds check but before the copy_from_user() call, causing an overflow. The fix involves using READ_ONCE() to capture all SQE field values into local variables before any validation or use, preventing the kernel from re-reading modified userspace memory. Requires local access and the ability to submit io_uring commands to a BSG device. The vulnerability was patched in commit 4b3c5965fca99f62d31c963294bd5b23cc488e97.
Affected products
- Linux Linux Kernel Approximately 5.15 and later (vulnerable code introduced in commit 7b6d3255e7f8)
Timeline
- 2026-09-16: disclosed: CVE-2026-90009 disclosed
- 2026-09-02: patched: Patch committed by Martin K. Petersen (Oracle) in commit 4b3c5965fca99f62d31c963294bd5b23cc488e97
- 2026-09-11: patched: Backported to stable trees via commit f033530105aa73d82c121d54b57f358e4865d2f4