CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved:

scsi: bsg: Pass reply len to bsg setup queue() to fit UFS ARPMB replies

bsg-lib allocates a 96-byte (SCSI SENSE BUFFERSIZE) reply buffer per job, but struct ufs rpmb reply is 104 bytes: a 40-byte struct ufs bsg reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd advanced rpmb req handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer.

Let each BSG transport pass its reply buffer size to bsg setup queue() and have ufs bsg request sizeof(struct ufs rpmb reply), so the full reply reaches user space. Other transports keep SCSI SENSE BUFFERSIZE.