CVE-2026-90009

CVE-2026-90009 is a time-of-check to time-of-use (TOCTOU) race in the Linux kernel's SCSI bsg driver's io_uring passthrough path, where scsi_bsg_uring_cmd() validates fields in the io_uring submission queue entry (SQE) that is shared with userspace via mmap and then re-reads them from that same mutable memory. A local attacker can change a field between the check and its use; the critical case is request_len, which can grow past sizeof(scmd->cmnd) after the bounds check and overflow the scmd->cmnd buffer during copy_from_user(), corrupting kernel memory. An attacker with low privileges and access to a bsg device node gains a kernel memory-corruption primitive that can lead to privilege escalation, information disclosure, or a system crash (CVSS 3.1 rates confidentiality, integrity, and availability impact as High). Any Linux system running a kernel that includes the bsg io_uring passthrough support is potentially affected, provided the SCSI bsg driver is present and its device nodes are accessible. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Install a kernel update containing the upstream fix that READ_ONCE()-copies the checked SQE fields into locals before use (your distribution's patched kernel build). Until patched, restrict access to /dev/bsg/* device nodes to trusted/root users and consider restricting io_uring on multi-user systems (e.g., the kernel.io_uring_disabled sysctl where available). Check whether CONFIG_BLK_DEV_BSG is enabled and whether unprivileged local users can open /dev/bsg nodes to assess actual exposure.