{"id":"CVE-2026-90009","published":"2026-09-16T11:17:13.553","lastModified":"2026-09-16T15:18:24.553","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Fix TOCTOU in io_uring passthrough command setup\n\nscsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE.\nUserspace can change a field after we check it and before we use it.\nrequest_len is the sharp case: it can grow past sizeof(scmd->cmnd) after\nthe bound check and overflow scmd->cmnd in copy_from_user().\n\nREAD_ONCE() the SQE fields we check or use into locals before use.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/4b3c5965fca99f62d31c963294bd5b23cc488e97","tags":[]},{"url":"https://git.kernel.org/stable/c/f033530105aa73d82c121d54b57f358e4865d2f4","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}