CVE-2026-99157

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99157", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:11.192Z", "dateUpdated": "2026-10-30T12:42:23.683Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:23.683Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\n\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/bsg-lib.c", "drivers/scsi/mpi3mr/mpi3mr_app.c", "drivers/scsi/scsi_transport_fc.c", "drivers/scsi/scsi_transport_iscsi.c", "drivers/scsi/scsi_transport_sas.c", "drivers/ufs/core/ufs_bsg.c", "include/linux/bsg-lib.h"], "versions": [{"version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "lessThan": "913a1876fbe9a168030013b9e6cb2746fe41fff4", "status": "affected", "versionType": "git"}, {"version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "lessThan": "bfb0582708b3432919a8baaa3a65de5fdb1490ea", "status": "affected", "versionType": "git"}, {"version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "lessThan": "2effbe746452c108188f85a6951f2b0b65653840", "status": "affected", "versionType": "git"}, {"version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "lessThan": "7a755f6d47b811d3abd93c1642ce5e63894540b8", "status": "affected", "versionType": "git"}, {"version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "lessThan": "ec6b083915e8146e147314a5f4f1285d07b57bfc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/bsg-lib.c", "drivers/scsi/mpi3mr/mpi3mr_app.c", "drivers/scsi/scsi_transport_fc.c", "drivers/scsi/scsi_transport_iscsi.c", "drivers/scsi/scsi_transport_sas.c", "drivers/ufs/core/ufs_bsg.c", "include/linux/bsg-lib.h"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/913a1876fbe9a168030013b9e6cb2746fe41fff4"}, {"url": "https://git.kernel.org/stable/c/bfb0582708b3432919a8baaa3a65de5fdb1490ea"}, {"url": "https://git.kernel.org/stable/c/2effbe746452c108188f85a6951f2b0b65653840"}, {"url": "https://git.kernel.org/stable/c/7a755f6d47b811d3abd93c1642ce5e63894540b8"}, {"url": "https://git.kernel.org/stable/c/ec6b083915e8146e147314a5f4f1285d07b57bfc"}], "title": "scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["block/bsg-lib.c", "drivers/scsi/mpi3mr/mpi3mr_app.c", "drivers/scsi/scsi_transport_fc.c", "drivers/scsi/scsi_transport_iscsi.c", "drivers/scsi/scsi_transport_sas.c", "drivers/ufs/core/ufs_bsg.c", "include/linux/bsg-lib.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "913a1876fbe9a168030013b9e6cb2746fe41fff4", "status": "affected", "version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "versionType": "git"}, {"lessThan": "bfb0582708b3432919a8baaa3a65de5fdb1490ea", "status": "affected", "version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "versionType": "git"}, {"lessThan": "2effbe746452c108188f85a6951f2b0b65653840", "status": "affected", "version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "versionType": "git"}, {"lessThan": "7a755f6d47b811d3abd93c1642ce5e63894540b8", "status": "affected", "version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "versionType": "git"}, {"lessThan": "ec6b083915e8146e147314a5f4f1285d07b57bfc", "status": "affected", "version": "6ff265fc5ef660499e0edc4641647e99eed3f519", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["block/bsg-lib.c", "drivers/scsi/mpi3mr/mpi3mr_app.c", "drivers/scsi/scsi_transport_fc.c", "drivers/scsi/scsi_transport_iscsi.c", "drivers/scsi/scsi_transport_sas.c", "drivers/ufs/core/ufs_bsg.c", "include/linux/bsg-lib.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\n\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE."}], "id": "CVE-2026-99157", "lastModified": "2026-10-30T13:21:49.530", "metrics": {}, "published": "2026-10-28T11:17:35.933", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2effbe746452c108188f85a6951f2b0b65653840"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a755f6d47b811d3abd93c1642ce5e63894540b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/913a1876fbe9a168030013b9e6cb2746fe41fff4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bfb0582708b3432919a8baaa3a65de5fdb1490ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec6b083915e8146e147314a5f4f1285d07b57bfc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via out-of-bounds write in UFS BSG request handling", "id": "2562735", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562735"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.", "A flaw was found in the Linux kernel's SCSI Generic (BSG) subsystem. A local attacker can exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges by triggering an out-of-bounds write in kernel memory. The issue arises because the buffer allocated for Universal Flash Storage (UFS) requests is smaller than the response structure returned by Advanced Replay Protected Memory Block (RPMB) commands, causing data to be written past the buffer boundary."], "name": "CVE-2026-99157", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99157\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99157\nhttps://git.kernel.org/stable/c/2effbe746452c108188f85a6951f2b0b65653840\nhttps://git.kernel.org/stable/c/7a755f6d47b811d3abd93c1642ce5e63894540b8\nhttps://git.kernel.org/stable/c/ec6b083915e8146e147314a5f4f1285d07b57bfc"], "statement": "This vulnerability is rated as Moderate severity because triggering the condition requires local administrative privileges alongside the presence of Universal Flash Storage (UFS) hardware. In typical Red Hat Enterprise Linux enterprise deployments, UFS devices are rarely utilized, and access to block SCSI generic device nodes is restricted to privileged users by default. Consequently, unprivileged local users cannot directly interact with the affected subsystem to cause kernel memory corruption or a system crash.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,2effbe746452c108188f85a6951f2b0b65653840)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,7a755f6d47b811d3abd93c1642ce5e63894540b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,ec6b083915e8146e147314a5f4f1285d07b57bfc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,2effbe746452c108188f85a6951f2b0b65653840)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,7a755f6d47b811d3abd93c1642ce5e63894540b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6ff265fc5ef660499e0edc4641647e99eed3f519,ec6b083915e8146e147314a5f4f1285d07b57bfc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.180598+00:00", "updated": "2026-11-02T02:00:09.129952+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}