CVE-2026-99157
NoneCVSS
—
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's storage reply handling can cause memory to be written past its allocated space, risking system crashes or instability on affected devices.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write of 8 bytes in the kernel BSG reply buffer when handling UFS Advanced RPMB responses due to allocation of only SCSI_SENSE_BUFFERSIZE (96 bytes) instead of the required 104 bytes for struct ufs_rpmb_reply.
Why it matters to the business
Memory corruption or kernel instability on Linux systems using UFS storage with Advanced RPMB commands; newly disclosed with no known exploitation yet but requires prompt patching to prevent future risk.
How an attack unfolds
An attacker with access to the BSG interface issues an Advanced RPMB command that triggers ufshcd_advanced_rpmb_req_handler to copy the full 104-byte ufs_rpmb_reply structure, overflowing the 96-byte buffer allocated by bsg-lib.
How to fix it
Update the Linux kernel to the version containing the fix that passes the correct reply buffer size (sizeof(struct ufs_rpmb_reply)) to bsg_setup_queue for the UFS BSG transport.
How to confirm the fix worked
Confirm the kernel source contains the change allowing each BSG transport to supply its required reply buffer size and that UFS BSG requests now allocate 104 bytes.
Typical attack path
- Obtain access to /dev/bsg device or equivalent BSG interface
- Craft and submit UFS Advanced RPMB request via BSG
- Trigger EHS data return that exceeds the undersized reply buffer
- Achieve out-of-bounds write in kernel memory
How to detect it
Review kernel logs for BSG or UFS RPMB related oops/panic messages and audit BSG device access attempts around the time of any anomalies.
What your security team should do
- Prioritize kernel update on all Linux systems using UFS storage
- Monitor for new exploit code given the one-day disclosure age
- Restrict unprivileged access to BSG devices until patched
The record
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsg_setup_queue() and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|