{"id":"CVE-2026-90009","published":"2026-09-16T11:17:13.553","lastModified":"2026-09-16T15:18:24.553","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Fix TOCTOU in io_uring passthrough command setup\n\nscsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE.\nUserspace can change a field after we check it and before we use it.\nrequest_len is the sharp case: it can grow past sizeof(scmd->cmnd) after\nthe bound check and overflow scmd->cmnd in copy_from_user().\n\nREAD_ONCE() the SQE fields we check or use into locals before use.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/4b3c5965fca99f62d31c963294bd5b23cc488e97","tags":[]},{"url":"https://git.kernel.org/stable/c/f033530105aa73d82c121d54b57f358e4865d2f4","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows a malicious user to exploit a time-of-check to time-of-use race condition in the io_uring passthrough command setup, potentially leading to buffer overflow and code execution.","exploitability":"Exploitation requires a race condition between checking and using a field in the SQE, making it moderately difficult. Precondition is the ability to manipulate the SQE after the initial check.","blast_radius":"If exploited, the impact could be severe, potentially leading to arbitrary code execution with kernel privileges.","remediation":"Upgrade to the fixed version 5.19.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","kernel","buffer-overflow"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:45:32.270Z"}}