{"id":"CVE-2026-90010","published":"2026-09-16T11:17:13.660","lastModified":"2026-09-16T15:18:24.657","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Cap io_uring sense copy to max_response_len\n\nCompletion copied scmd->sense_len to the user response buffer without\nhonoring max_response_len. After a valid sense, the midlayer sets\nsense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller\nuser buffer was overrun.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/5d326efc334ea21afd8161f6ca53e17de71948a9","tags":[]},{"url":"https://git.kernel.org/stable/c/ece06de726737e887dc0225c8283477624f8ae21","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows overwriting of a user buffer with a larger sense length than intended, posing a risk of data corruption or leakage.","exploitability":"Exploitation requires a user with low privileges and access to the affected scsi device, making it moderately exploitable.","blast_radius":"If exploited, the vulnerability could lead to data corruption or unauthorized access to sensitive information.","remediation":"Upgrade to the Linux kernel version 6.1.11 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","privilege-escalation","data-leakage"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:45:31.470Z"}}