Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-90009

scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user(). READ_ONCE() the SQE fields we check or use into locals before use.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to < f033530105aa73d82c121d54b57f358e4865d2f4affected
  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to < 4b3c5965fca99f62d31c963294bd5b23cc488e97affected

Linux Linux

Default version status: affected

  • 7.1affected
  • 0 to < 7.1unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References