UBUNTU-CVE-2026-99157: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSISENSEBUFFERSIZE) reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcdadvancedrpmbreqhandler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsgsetupqueue() and have ufsbsg request sizeof(struct ufsrpmbreply), so the full reply reaches user space. Other transports keep SCSISENSEBUFFERSIZE.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are in scope?
The affected software list includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-azure-fde, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-realtime, and ubuntu/linux-riscv. Exposure is specific to the UFS BSG Advanced RPMB reply path.
What is required to trigger the out-of-bounds write?
An Advanced RPMB command must return an EHS as part of a UFS RPMB reply. The 104-byte reply is then copied into a 96-byte BSG reply buffer, causing an 8-byte overwrite.
Are other BSG transports changed by the fix?
No change is described for other transports: they continue to use SCSI_SENSE_BUFFERSIZE. The larger reply-buffer allocation is requested specifically by UFS BSG.