CVE-2026-99157: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Pass replylen to bsgsetupqueue() to fit UFS ARPMB replies
bsg-lib allocates a 96-byte (SCSISENSEBUFFERSIZE) reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcdadvancedrpmbreqhandler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer.
Let each BSG transport pass its reply buffer size to bsgsetupqueue() and have ufsbsg request sizeof(struct ufsrpmbreply), so the full reply reaches user space. Other transports keep SCSISENSEBUFFERSIZE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update each BSG transport to pass its reply buffer size to bsg_setup_queue(); for ufs_bsg, request sizeof(struct ufs_rpmb_reply) so the reply buffer accommodates the 104-byte struct ufs_rpmb_reply and its 64-byte EHS.