TOCTOU Vulnerability in Linux Kernel Impacting SCSI BSG Commands

CVE-2026-90009

What is CVE-2026-90009?

A vulnerability has been identified in the Linux kernel related to the SCSI block layer (bsg) implementation. The issue arises from a time-of-check to time-of-use (TOCTOU) flaw in the io_uring passthrough command setup. Specifically, the scsi_bsg_uring_cmd() function reads the bsg_uring_cmd from shared memory-mapped I/O. This setup allows userspace modifications to a specific field after validation, leading to potential buffer overflows. If the request length exceeds the defined bounds, it can overwrite critical memory locations when executing the copy_from_user() method, posing significant security risks. It is essential for users and administrators to ensure their systems are updated to prevent exploitation.

References