Riskcovery

CVE-2026-90009

scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

State
Published
Severity
7.8 High
Published
Sep 16, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().

READ_ONCE() the SQE fields we check or use into locals before use.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to before f033530105aa73d82c121d54b57f358e4865d2f4Affected
  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to before 4b3c5965fca99f62d31c963294bd5b23cc488e97Affected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.