CVE-2026-99157
Received Received - Intake

BaseFortify

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsg_setup_queue() and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99157
EUVD
EUVD-2026-111909

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 6ff265fc5ef660499e0edc4641647e99eed3f519
Linux Linux 6ff265fc5ef660499e0edc4641647e99eed3f519
Linux Linux 6ff265fc5ef660499e0edc4641647e99eed3f519
Linux Linux 6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow issue in the Linux kernel's SCSI Block Commands (bsg) subsystem. The bsg-lib allocates a 96-byte reply buffer for each job, but the UFS Advanced RPMB (Replay Protected Memory Block) reply structure is 104 bytes. When an Advanced RPMB command returns an EHS (Extended Header Segment), it writes 8 bytes past the end of the allocated buffer, causing a buffer overflow.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI BSG (Block Scsi Generic) layer and UFS (Universal Flash Storage) RPMB (Replay Protected Memory Block) handling. Detection requires checking kernel versions and examining SCSI BSG-related logs or errors. No direct network detection commands are applicable as this is a local kernel issue.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It specifically affects systems using UFS storage devices with Advanced RPMB commands.

Mitigation Strategies

Apply the latest Linux kernel updates that include the fix for this issue. Monitor kernel patch notes for CVE-2026-99157. If immediate patching is not possible, restrict access to UFS devices or disable RPMB-related operations until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart