CVE-2026-99157

A flaw was found in the Linux kernel's SCSI Generic (BSG) subsystem. A local attacker can exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges by triggering an out-of-bounds write in kernel memory. The issue arises because the buffer allocated for Universal Flash Storage (UFS) requests is smaller than the response structure returned by Advanced Replay Protected Memory Block (RPMB) commands, causing data to be written past the buffer boundary.

This vulnerability is rated as Moderate severity because triggering the condition requires local administrative privileges alongside the presence of Universal Flash Storage (UFS) hardware. In typical Red Hat Enterprise Linux enterprise deployments, UFS devices are rarely utilized, and access to block SCSI generic device nodes is restricted to privileged users by default. Consequently, unprivileged local users cannot directly interact with the affected subsystem to cause kernel memory corruption or a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.