CVE-2026-90009: Linux Kernel SCSI BSG Race Condition Flaw

CVE-2026-90009 Overview

CVE-2026-90009 is a time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's SCSI Block SCSI Generic (BSG) driver. The flaw exists in scsi_bsg_uring_cmd(), which reads the bsg_uring_cmd structure directly from a shared memory-mapped io_uring Submission Queue Entry (SQE). A local unprivileged user with access to an io_uring instance can modify the request_len field between the bounds check and the copy operation. This inconsistency allows request_len to exceed sizeof(scmd->cmnd), causing a heap buffer overflow in copy_from_user(). The issue affects kernels that support the BSG io_uring passthrough command path.

Critical Impact
A local attacker can trigger a kernel heap buffer overflow in the SCSI BSG driver, leading to memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel versions containing the SCSI BSG io_uring passthrough command handler prior to the fix commits
Distributions shipping vulnerable stable kernel branches referenced in the upstream stable tree
Systems where unprivileged users have access to /dev/bsg/* devices and io_uring

Discovery Timeline

2026-09-16 - CVE-2026-90009 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90009

Vulnerability Analysis

The vulnerability resides in the scsi_bsg_uring_cmd() function within the SCSI BSG subsystem. This function processes SCSI passthrough commands submitted through the io_uring interface. Because io_uring SQEs live in memory shared between kernel and userspace, the kernel must treat all SQE fields as untrusted for the duration of processing.

The kernel reads request_len from the SQE, validates it against sizeof(scmd->cmnd), and later uses the same field as the length argument to copy_from_user(). Between these two accesses, userspace can rewrite request_len in the shared mapping. The kernel then copies more data than the fixed-size scmd->cmnd buffer can hold, corrupting adjacent kernel heap memory.

Root Cause

The root cause is unsafe reuse of shared, user-writable memory as the source of truth during command validation and execution [CWE-367]. The BSG passthrough path did not snapshot SQE fields into local variables before validation and use, allowing the checked value and the used value to diverge.

Attack Vector

Exploitation requires local access with permission to open a BSG device node and submit io_uring operations. The attacker maps the SQE region, submits a passthrough command with a valid request_len, and races a second thread that overwrites request_len with an oversized value after the bounds check. When the kernel calls copy_from_user() with the mutated length, a controlled heap overflow occurs against the SCSI command buffer.

The upstream fix wraps each SQE field access with READ_ONCE() and stores results in local variables. This ensures that the value validated is the value used, closing the race window. See the fix commits 4b3c5965fca9 and f033530105aa for the exact changes.

Detection Methods for CVE-2026-90009

Indicators of Compromise

Unexpected kernel oops or panic messages referencing scsi_bsg_uring_cmd or copy_from_user in dmesg
KASAN or SLUB debug reports flagging out-of-bounds writes to scsi_cmnd structures
Unprivileged processes opening /dev/bsg/* device nodes and submitting high volumes of io_uring SQEs

Detection Strategies

Monitor process telemetry for unusual access patterns to /dev/bsg/* from non-administrative users or containers
Correlate io_uring setup syscalls with subsequent BSG device access to identify potential exploitation attempts
Enable kernel hardening features such as KASAN in test environments to surface memory corruption during fuzzing

Monitoring Recommendations

Collect kernel ring buffer messages centrally and alert on crashes involving SCSI or BSG symbols
Track kernel version inventory across the fleet to identify hosts still running vulnerable builds
Audit which users, containers, and workloads legitimately require BSG passthrough access

How to Mitigate CVE-2026-90009

Immediate Actions Required

Apply the upstream stable kernel patches referenced in commits 4b3c5965fca9 and f033530105aa as soon as vendor builds are available
Restrict access to /dev/bsg/* device nodes to trusted administrative accounts only
Review container and virtualization configurations to ensure BSG devices are not exposed to untrusted workloads

Patch Information

The fix was merged upstream and replaces direct SQE field reads with READ_ONCE() into local variables inside scsi_bsg_uring_cmd(). Apply the vendor-supplied kernel update that incorporates the upstream commit 4b3c5965fca9 and its stable backport in commit f033530105aa. Rebuild and reboot affected systems after installation.

Workarounds

Remove or restrict permissions on BSG device nodes using udev rules so only privileged accounts can open them
Disable io_uring for untrusted users where operationally feasible via sysctl kernel.io_uring_disabled=2
Avoid exposing SCSI passthrough devices to unprivileged containers or sandboxed processes

bash

# Configuration example: restrict io_uring to privileged users and audit BSG access
sysctl -w kernel.io_uring_disabled=2
chmod 600 /dev/bsg/*
auditctl -w /dev/bsg -p rwa -k bsg_access