{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90009","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.781Z","datePublished":"2026-09-16T10:33:17.446Z","dateUpdated":"2026-09-16T14:41:25.065Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-16T14:41:25.065Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Fix TOCTOU in io_uring passthrough command setup\n\nscsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE.\nUserspace can change a field after we check it and before we use it.\nrequest_len is the sharp case: it can grow past sizeof(scmd->cmnd) after\nthe bound check and overflow scmd->cmnd in copy_from_user().\n\nREAD_ONCE() the SQE fields we check or use into locals before use."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - scsi_bsg_uring_cmd() is reached only via a local io_uring IORING_OP_URING_CMD on a SCSI BSG device node (/dev/bsg/<h:c:i:l>); io_uring and BSG are local syscall/device paths, not a network protocol handler.\nAC:L - The attacker owns both sides of the TOCTOU: one thread submits the uring_cmd while another rewrites request_len in the shared mmap'd SQE. The inline issue path never copies the SQE first, and scsi_alloc_request() sits between the bound check and copy_from_user, making the race attacker-driven and retryable.\nPR:L - bsg_open() has no capability check; access is only DAC on /dev/bsg/* for ordinary SCSI devices. scsi_cmd_allowed() runs after the overflow. Disk/cdrom group membership and uaccess on removable SCSI/USB devices grant this to unprivileged local users without init-namespace root.\nUI:N - The attacker opens the BSG node, creates an io_uring ring with SQE128/CQE32, and submits the racing passthrough command themselves; no victim action is required.\nS:U - The overflow corrupts the blk-mq scsi_cmnd PDU and adjacent kernel heap in the same host kernel security authority, enabling local privilege escalation rather than a VM, IOMMU, or sandbox boundary crossing.\nC:H - copy_from_user() overflows the 32-byte scmd->cmnd into scsi_cmnd pointer fields (sdb, sense_buffer, host_scribble) and adjacent heap with attacker-controlled bytes, which can be groomed into kernel memory disclosure.\nI:H - The same attacker-controlled heap overflow overwrites kernel pointers and adjacent blk-mq request objects, providing a write primitive exploitable for control-flow hijacking and privilege escalation.\nA:H - A large request_len smash or later use of corrupted scsi_cmnd pointers causes a kernel oops or panic; even a failed copy_from_user still writes through kernel memory until a fault, then frees the corrupted request."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/scsi_bsg.c"],"versions":[{"version":"7b6d3255e7f8c6df2d21504c47808e3ce84649ac","lessThan":"f033530105aa73d82c121d54b57f358e4865d2f4","status":"affected","versionType":"git"},{"version":"7b6d3255e7f8c6df2d21504c47808e3ce84649ac","lessThan":"4b3c5965fca99f62d31c963294bd5b23cc488e97","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/scsi_bsg.c"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.3-rc2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f033530105aa73d82c121d54b57f358e4865d2f4"},{"url":"https://git.kernel.org/stable/c/4b3c5965fca99f62d31c963294bd5b23cc488e97"}],"title":"scsi: bsg: Fix TOCTOU in io_uring passthrough command setup","x_generator":{"engine":"bippy-1.2.0"}}}}