EUVD-2026-80618
GHSA-jqrf-j7h5-x2p4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local bsg-device access gives AV:L/PR:L; deterministic sense overflow is AC:L; impact is a bounded write causing corruption/crash, so I:L/A:H and no demonstrated leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Cap io_uring sense copy to max_response_len
Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.
AnalysisAI
An out-of-bounds write in the Linux kernel's SCSI bsg io_uring completion path allows a local attacker with low privileges (CVSS PR:L) to overrun a user-supplied response buffer that is smaller than SCSI_SENSE_BUFFERSIZE, because the completed sense length is copied back without being capped to the caller's max_response_len. The io_uring-backed bsg passthrough interface that exposes the flaw was introduced in kernel 7.1 and is fixed in 7.2.5 and 7.3-rc2, so exposure is limited to very recent kernels on hosts where a bsg device node is reachable; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a SCSI generic (bsg) device node and use of the io_uring-based bsg passthrough completion path (newly added in kernel 7.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 7.2.5 (commit 5d326efc334ea21afd8161f6ca53e17de71948a9) and Linux 7.3-rc2 (commit ece06de726737e887dc0225c8283477624f8ae21), both available from the stable Git tree; upgrade to 7.2.5 or 7.3-rc2 (or later) or apply the referenced commit for any kernel backport carrying the 7.1 io_uring bsg passthrough feature. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts and identify any running kernel versions 7.1 or later, especially those with reachable bsg device nodes or io_uring passthrough enabled, and restrict /dev/bsg* permissions to root-only as an interim containment measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today