CVE-2026-99157
Description
A flaw was found in the Linux kernel's SCSI Generic (BSG) subsystem. A local attacker can exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges by triggering an out-of-bounds write in kernel memory. The issue arises because the buffer allocated for Universal Flash Storage (UFS) requests is smaller than the response structure returned by Advanced Replay Protected Memory Block (RPMB) commands, causing data to be written past the buffer boundary.
Statement
This vulnerability is rated as Moderate severity because triggering the condition requires local administrative privileges alongside the presence of Universal Flash Storage (UFS) hardware. In typical Red Hat Enterprise Linux enterprise deployments, UFS devices are rarely utilized, and access to block SCSI generic device nodes is restricted to privileged users by default. Consequently, unprivileged local users cannot directly interact with the affected subsystem to cause kernel memory corruption or a system crash.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
