All vulnerabilities
CVE-2026-99157

Linux: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2effbe746452c108188f85a6951f2b0b65653840Also 7a755f6d47b811d3abd93c1642ce5e63894540b8CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 2effbe746452c108188f85a6951f2b0b65653840LinuxCVE List
  • 7a755f6d47b811d3abd93c1642ce5e63894540b8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer.

Let each BSG transport pass its reply buffer size to bsg_setup_queue() and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.

Text from CVE List

Affected versions 8

  • Linuxaffected: 6ff265fc5ef660499e0edc4641647e99eed3f519 before 2effbe746452c108188f85a6951f2b0b65653840CVE List
  • Linuxaffected: 6ff265fc5ef660499e0edc4641647e99eed3f519 before 7a755f6d47b811d3abd93c1642ce5e63894540b8CVE List
  • Linuxaffected: 6ff265fc5ef660499e0edc4641647e99eed3f519 before ec6b083915e8146e147314a5f4f1285d07b57bfcCVE List
  • Linuxaffected: 6.3CVE List
  • Linuxunaffected: all versions before 6.3CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3