CVE-2026-90010

The Linux kernel's SCSI bsg driver overruns the user-supplied response buffer when completing io_uring passthrough requests: the completion path copied the reported sense length into the user's buffer without capping the copy to the user-declared max_response_len. A local user who can submit commands to a bsg device can trigger this by issuing a command that returns SCSI sense data longer than their response buffer, since after valid sense the midlayer sets sense_len to the real length, up to SCSI_SENSE_BUFFERSIZE. The overrun writes past the end of the caller's buffer, giving a local attacker potential denial of service, memory corruption, or disclosure per the CVSS 7.8 rating (C:H/I:H/A:H, local, low privileges). Any Linux system running a kernel with io_uring bsg passthrough support and SCSI devices present is affected, though exploitation requires access to the /dev/bsg device node, which distributions typically restrict to root or the disk group. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.

What to do: Update to a kernel build that includes the upstream fix 'scsi: bsg: Cap io_uring sense copy to max_response_len' as it lands in your distribution's security updates. Until patched, restrict write/open access to /dev/bsg/* device nodes to trusted root or disk-group users and audit udev rules for looser permissions; where supported, kernel.io_uring_disabled can be set to block unprivileged io_uring use as a stopgap. Check whether any local service accounts or containers can reach bsg device nodes on affected hosts.