CVE-2026-90010: Linux Kernel SCSI BSG Buffer Overflow

CVE-2026-90010 Overview

CVE-2026-90010 is a Linux kernel vulnerability in the SCSI block SG (bsg) driver's io_uring completion path. The completion handler copies scmd->sense_len bytes into the user-supplied response buffer without honoring the caller-specified max_response_len. After a valid SCSI sense is returned, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE, which is 96 bytes), causing a write past the end of a smaller user buffer. A local user with permission to issue bsg requests can trigger memory corruption in kernel-adjacent user memory, potentially leading to privilege escalation on affected kernels.

Critical Impact
A local, low-privileged user issuing crafted bsg io_uring requests can overrun a user response buffer with SCSI sense data, resulting in confidentiality, integrity, and availability loss on affected Linux kernels.

Affected Products

Linux kernel with SCSI bsg driver and io_uring integration
Distributions shipping unpatched upstream kernels prior to the referenced fix commits
Systems exposing /dev/bsg/* to non-root users or containers

Discovery Timeline

2026-09-16 - CVE-2026-90010 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90010

Vulnerability Analysis

The vulnerability resides in the SCSI bsg driver's io_uring completion path. When a SCSI command completes, the driver copies sense data from scmd->sense_len into the user response buffer. The copy operation uses sense_len as the length argument without clamping it against the caller-provided max_response_len.

After a successful sense retrieval, the SCSI midlayer populates sense_len with the actual sense payload size, which can reach SCSI_SENSE_BUFFERSIZE (96 bytes). If the userspace caller supplied a smaller response buffer through the io_uring submission queue entry, the completion path writes beyond the buffer boundary. This is an out-of-bounds write into the user address space that the kernel was instructed to trust as sized by max_response_len.

The upstream fix caps the copy length to the minimum of sense_len and max_response_len before invoking the user-space copy. See the kernel commit change and the follow-up kernel commit update for the corrective patches.

Root Cause

The root cause is a missing bounds check in the bsg io_uring completion handler. The code trusts scmd->sense_len as the transfer size instead of enforcing max_response_len as an upper bound. This is a classic out-of-bounds write pattern where two independent length fields exist and only one is honored during a copy.

Attack Vector

Exploitation requires local access with permission to open a bsg device node and submit io_uring requests. An attacker crafts a bsg request that provokes a SCSI sense response, sets max_response_len to a value smaller than the eventual sense_len, and points the response buffer at a target user page. When the command completes, the kernel writes the full sense payload past the intended buffer, corrupting adjacent memory the attacker controls placement of. No user interaction is required and attack complexity is low.

No public proof-of-concept code is available. See the upstream commits referenced above for the exact code path.

Detection Methods for CVE-2026-90010

Indicators of Compromise

Unexpected io_uring submissions targeting /dev/bsg/* device nodes from non-administrative users or container workloads.
Kernel log entries referencing SCSI sense handling anomalies or KASAN reports flagging out-of-bounds writes in the bsg completion path.
Unexplained process crashes or memory corruption in userspace processes that recently invoked bsg io_uring operations.

Detection Strategies

Audit open() and io_uring_setup() syscall sequences that target bsg device nodes, particularly from unprivileged UIDs and container namespaces.
Deploy KASAN-enabled kernels in test environments to surface out-of-bounds writes in the bsg completion path during fuzzing.
Correlate SCSI sense-generating command patterns with io_uring completion events to identify anomalous access sequences.

Monitoring Recommendations

Enable Linux Audit rules on /dev/bsg/* access and alert on non-root openers.
Forward kernel ring buffer messages to a centralized log platform and alert on SCSI subsystem warnings, KASAN reports, and oops traces.
Track kernel package versions across the fleet and flag hosts running kernels prior to the upstream fix commits.

How to Mitigate CVE-2026-90010

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits or the vendor-backported update for your distribution.
Restrict access to /dev/bsg/* device nodes to root only and remove bsg capabilities from unprivileged containers.
Inventory hosts with SCSI bsg exposure and prioritize patching multi-tenant systems and container hosts.

Patch Information

The fix caps the sense copy length by max_response_len in the bsg io_uring completion path. Apply commits 5d326efc334e and ece06de72673 or upgrade to a distribution kernel that includes both changes. Reboot after installing the updated kernel package.

Workarounds

Set restrictive permissions on /dev/bsg/* so only trusted administrative accounts can issue bsg ioctls or io_uring operations.
Disable the bsg module where SCSI generic pass-through is not required by blacklisting it in /etc/modprobe.d/.
Drop CAP_SYS_RAWIO from container and workload profiles that do not require raw SCSI access.

bash

# Configuration example
# Restrict bsg device access to root
chmod 600 /dev/bsg/*

# Blacklist bsg module if pass-through is not required
echo 'blacklist bsg' | sudo tee /etc/modprobe.d/blacklist-bsg.conf
sudo update-initramfs -u

# Verify running kernel includes the fix commit
uname -r
dpkg -l | grep linux-image   # Debian/Ubuntu
rpm -q kernel                # RHEL/Fedora/SUSE