CVE-2026-90010: scsi: bsg: Cap io_uring sense copy to max_response_len
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Cap iouring sense copy to maxresponselen
Completion copied scmd->senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length (up to SCSISENSEBUFFERSIZE), so a smaller user buffer was overrun.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The issue is triggered through the SCSI bsg io_uring completion path when a command returns valid sense data and the user-provided response buffer is smaller than the actual sense data length. The completion code could then copy up to the real sense length without honoring max_response_len.
Who is exposed to this issue?
Systems using the Linux kernel SCSI bsg interface with io_uring are exposed when software submits affected requests with an undersized response buffer. The provided information does not identify whether bsg or io_uring access is enabled by default.
What does the fix change?
The fix caps the io_uring sense-data copy at max_response_len, preventing completion handling from copying more sense data than the response buffer permits.