CVE-2026-90009

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue exists in the scsi bsg uring cmd() function. The function reads bsg uring cmd from a shared memory-mapped Submission Queue Entry (SQE). A user can modify a field after it has been validated but before it is utilized. Specifically, the request len variable can be increased beyond the size of scmd->cmnd after the boundary check, leading to a buffer overflow in copy from user().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.