CVE-2026-90009 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().
READ_ONCE() the SQE fields we check or use into locals before use.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) race condition within the SCSI block layer generic command interface, specifically affecting io_uring passthrough commands. This vulnerability arises in the scsi_bsg_uring_cmd function, which processes submission queue entries submitted by user-space applications via memory-mapped regions. The core issue lies in how the kernel handles data from these shared structures without proper atomicity guarantees during critical validation and usage phases.
The technical flaw occurs because the kernel reads fields from the bsg_uring_cmd structure directly from a shared mmap'd Submission Queue Entry. User-space processes have write access to this memory region, allowing them to modify field values between the moment the kernel checks their validity and the moment it uses those values for subsequent operations. This window of opportunity enables an attacker to manipulate critical parameters such as request_len after initial bounds checking has occurred but before data copying takes place.
The most severe impact involves the request_len field, which specifies the length of data to be copied from user space into kernel memory. An attacker can initially provide a value that passes the initial bound check against sizeof(scmd->cmnd). However, by modifying this value in the shared memory region before the actual copy operation, the attacker can cause request_len to exceed the allocated buffer size. This leads to an out-of-bounds write when copy_from_user attempts to transfer data into scmd->cmnd, potentially resulting in kernel memory corruption or arbitrary code execution depending on the specific context and available heap layout techniques.
This vulnerability maps directly to CWE-367, which defines Time-of-check Time-of-use errors as a class of software weaknesses where security checks are performed at one point but rely on conditions that may change before the result is used. In terms of attack vectors, this aligns with ATT&CK technique T1059, specifically command and script interpretation through system APIs, though more precisely it represents an exploitation of race conditions in kernel interfaces to escalate privileges or destabilize the system. The vulnerability affects systems using io_uring for high-performance I/O operations involving SCSI devices, particularly those configured for passthrough commands where direct hardware access is permitted.
The operational impact includes potential denial of service through kernel crashes or panics caused by memory corruption, as well as privilege escalation if an unprivileged user can exploit the buffer overflow to execute arbitrary code with kernel privileges. The risk is heightened in multi-tenant environments or virtualized systems where multiple processes may interact with shared SCSI devices concurrently. Attackers could leverage this flaw to bypass security boundaries established by mandatory access control mechanisms that rely on proper input validation within kernel subsystems.
The resolution involves implementing READ_ONCE macros for all SQE fields that are checked or used during command setup. This ensures that the values read from memory remain consistent throughout the critical section, preventing user-space modifications from affecting the operation mid-execution. By capturing these values into local variables before performing any checks or subsequent operations, the kernel eliminates the race condition window entirely.
Mitigation strategies for organizations running affected Linux kernels include immediate patching to the latest stable release that includes this fix. For systems where patching is not immediately feasible, restricting io_uring usage in production environments and limiting access to SCSI passthrough capabilities can reduce exposure. Additionally, implementing strict user-space sandboxing through namespaces or cgroups limits the potential blast radius if exploitation occurs. Security monitoring should focus on unusual patterns of memory mapping and rapid modifications to shared kernel interfaces as indicators of attempted exploitation attempts.