Linux kernel bsg: sense data copy ignores max_response_len and overruns the user buffer

Impact

Completion of an io_uring-submitted SCSI generic command copied scmd->sense_len bytes into the caller's response buffer without honouring max_response_len, so a caller that supplied a buffer smaller than the real sense length (up to SCSI_SENSE_BUFFERSIZE) had memory past the buffer overwritten. NVD rates it 7.8 local with high confidentiality, integrity and availability impact, consistent with local privilege escalation. On a GPU node this matters where /dev/bsg or SG passthrough is exposed to a workload or a storage management container - direct disk passthrough setups are the realistic path. A node that hits this needs draining before it can take the fixed kernel.

Who can reach it

Local user with access to a SCSI bsg device node and the ability to submit io_uring passthrough commands. Authentication as a local user is required; no remote path.

What to do

Take the stable kernel containing commits 5d326efc334e / ece06de72673, then drain and reboot each affected node - kernel fixes are not hot-patchable here. Until then, restrict access to /dev/bsg* so unprivileged tenants and containers cannot reach SCSI passthrough.

References

Related entries

• Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High