DEBIAN-CVE-2026-99157: Debian/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSISENSEBUFFERSIZE) reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcdadvancedrpmbreqhandler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsgsetupqueue() and have ufsbsg request sizeof(struct ufsrpmbreply), so the full reply reaches user space. Other transports keep SCSISENSEBUFFERSIZE.