CVE-2026-90009: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Fix TOCTOU in iouring passthrough command setup
scsibsguringcmd() reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copyfromuser().
READONCE() the SQE fields we check or use into locals before use.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs the ability to submit io_uring passthrough commands through the SCSI BSG interface and modify fields in the shared memory-mapped submission queue entry while the kernel is processing it.
What is the security impact of the race condition?
The request_len field can be changed after its bounds check, allowing it to exceed the size of scmd->cmnd when copy_from_user() runs. This can overflow the kernel command buffer.
How is the vulnerability fixed?
The fix reads the relevant bsg_uring_cmd fields from the shared SQE once into local variables using READ_ONCE(), then uses those local values for validation and processing.