What is the CVSS score of EUVD-2026-80618?

EUVD-2026-80618 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Linux Kernel are affected by EUVD-2026-80618?

A memory-safety flaw in the Linux kernel's SCSI bsg io_uring interface affects hosts running very recent 7.x kernels, allowing a local low-privileged user who can reach a bsg device node to corrupt…. A patch is available.

How to fix or mitigate EUVD-2026-80618?

Within 24 hours, inventory all Linux hosts and identify any running kernel versions 7.1 or later, especially those with reachable bsg device nodes or io_uring passthrough enabled, and restrict /dev/bsg* permissions to root-only as an interim containment measure. Within 7 days, upgrade affected systems to the vendor-released kernel versions 7.2.5 or 7.3-rc2 (or later) and confirm the running version with uname -r after reboot. Within 30 days, validate patch compliance across all affected hosts, review whether the bsg io_uring interface is required for business workloads, and remove or disable unnecessary bsg device access to reduce future exposure.

Linux Kernel EUVD-2026-80618

| CVE-2026-90010 HIGH

2026-09-16 Linux

GHSA-jqrf-j7h5-x2p4

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Local bsg-device access gives AV:L/PR:L; deterministic sense overflow is AC:L; impact is a bounded write causing corruption/crash, so I:L/A:H and no demonstrated leak (C:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Denial Of Service added

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 16, 2026 - 16:26 vuln.today

CVSS changed

Sep 16, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:33 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 16, 2026 - 10:33 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: bsg: Cap io_uring sense copy to max_response_len

Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.

AnalysisAI

An out-of-bounds write in the Linux kernel's SCSI bsg io_uring completion path allows a local attacker with low privileges (CVSS PR:L) to overrun a user-supplied response buffer that is smaller than SCSI_SENSE_BUFFERSIZE, because the completed sense length is copied back without being capped to the caller's max_response_len. The io_uring-backed bsg passthrough interface that exposes the flaw was introduced in kernel 7.1 and is fixed in 7.2.5 and 7.3-rc2, so exposure is limited to very recent kernels on hosts where a bsg device node is reachable; no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires local access to a SCSI generic (bsg) device node and use of the io_uring-based bsg passthrough completion path (newly added in kernel 7.1). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: Linux 7.2.5 (commit 5d326efc334ea21afd8161f6ca53e17de71948a9) and Linux 7.3-rc2 (commit ece06de726737e887dc0225c8283477624f8ae21), both available from the stable Git tree; upgrade to 7.2.5 or 7.3-rc2 (or later) or apply the referenced commit for any kernel backport carrying the 7.1 io_uring bsg passthrough feature. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux hosts and identify any running kernel versions 7.1 or later, especially those with reachable bsg device nodes or io_uring passthrough enabled, and restrict /dev/bsg* permissions to root-only as an interim containment measure. …

Threat intelligence, references, and detailed analysis are available after sign-in.