Strix
63.9K

CVE-2026-90010

HIGHCVSS 7.8/10

Last modified

CVE-2026-90010 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun..

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 7b6d3255e7f8c6df2d21504c47808e3ce84649ac, < 5d326efc334ea21afd8161f6ca53e17de71948a9; >= 7b6d3255e7f8c6df2d21504c47808e3ce84649ac, < ece06de726737e887dc0225c8283477624f8ae21
LinuxLinux7.1

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90010?
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.
How severe is CVE-2026-90010?
CVE-2026-90010 has a CVSS score of 7.8/10 (HIGH severity).
How do I fix CVE-2026-90010?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90010?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST