Executive brief
The Linux kernel's SCSI block generic (bsg) driver contains a buffer overflow vulnerability in its io_uring command handler. When processing SCSI sense data, the driver copies more data than a user-provided buffer can hold, leading to memory corruption. An attacker with access to issue io_uring SCSI commands could exploit this to crash the system or potentially execute code.
Technical details
The vulnerability is a buffer overflow in the SCSI bsg io_uring handler (drivers/scsi/scsi_bsg.c). The root cause is that sense data completion logic copies scmd->sense_len bytes to the user response buffer without respecting the user-supplied max_response_len limit. When a valid SCSI sense condition occurs, the midlayer sets sense_len to the full length (up to SCSI_SENSE_BUFFERSIZE ~96 bytes), causing an overrun of smaller user buffers. The vulnerability requires the ability to issue io_uring SCSI commands. The fix caps the sense data copy to the minimum of the actual sense length and the user-provided buffer size limit by introducing a max_response_len field in the pdu structure. A patch was committed to the Linux kernel stable tree (commit ece06de726737e887dc0225c8283477624f8ae21).
Affected products
- Linux Linux kernel Various versions (patch applied to 5.x and 6.x series)
Timeline
- 2026-09-16: disclosed: CVE-2026-90010 published
- 2026-09-02: patched: Upstream patch committed (ece06de726737e887dc0225c8283477624f8ae21)
- 2026-09-11: patched: Stable tree patch applied (5d326efc334ea21afd8161f6ca53e17de71948a9)