{"id":"CVE-2026-99157","kind":"vulnerability","aliases":["CVE-2026-99157"],"related":[],"title":"Linux kernel: UFS RPMB reply buffer too small, heap write overflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\n\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.","summary":"The Linux SCSI BSG transport allocates a 96-byte reply buffer, but the UFS Advanced RPMB reply can be 104 bytes, so an extra 8 bytes are written past the end of the buffer. The sources do not state what an attacker can achieve beyond the out-of-bounds write.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","mobile-hardware","ufs-storage"],"not_affected_if":["no-ufs-storage"],"how_to_check":"- unknown","fix":"- Upgrade to a Linux kernel release that includes the upstream commit 'scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies'\n- unknown","status":"open","published_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:50+00:00","updated_at":"2026-10-28T11:35:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:35:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a Linux kernel release that includes the upstream commit 'scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies'\n- unknown","reach":"local","title":"Linux kernel: UFS RPMB reply buffer too small, heap write overflow","impact":"medium","summary":"The Linux SCSI BSG transport allocates a 96-byte reply buffer, but the UFS Advanced RPMB reply can be 104 bytes, so an extra 8 bytes are written past the end of the buffer. The sources do not state what an attacker can achieve beyond the out-of-bounds write.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ufs-storage","embedded","mobile-hardware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"out-of-bounds kernel heap write of 8 bytes; code execution not stated","analyst_note":"Find the affected kernel version range and whether the bsg/UFS RPMB path is reachable without privileges, from the NVD entry and the upstream kernel commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ufs-storage"],"who_is_affected":"Systems running a Linux kernel with UFS storage and the bsg transport using Advanced RPMB commands are the ones the description points at. The sources do not say which kernel versions or hardware are affected, or whether an unprivileged user can trigger the path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3550,"output_tokens":565,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99157':14A,17A '104':48B,124C '40':127C,157C '64':136C '8':53B,162C '96':36B,109C 'achiev':72B 'advanc':43B,141C,148C 'alloc':34B,107C 'arpmb':102C 'attack':70B 'beyond':73B 'bound':78B 'bsg':32B,91C,96C,105C,131C,172C,180C,186C 'bsg-lib':104C 'buffer':6A,39B,62B,115C,169C,177C 'buffers':113C,205C 'byte':37B,49B,54B,110C,125C,128C,137C,158C,163C 'command':143C 'copi':152C 'cve':12A,15A 'eh':138C,146C 'embed':18B 'end':59B,166C 'extra':52B 'fit':100C 'follow':85C,133C 'full':195C 'handler':151C 'hardwar':25B 'header':159C 'heap':9A 'infrastructur':19B 'job':117C 'keep':202C 'kernel':2A,22B,83C 'len':94C 'let':170C 'lib':106C 'linux':1A,21B,30B,82C 'linux-kernel':20B 'mobil':24B 'mobile-hardwar':23B 'out-of-bound':75B 'overflow':11A 'pass':92C,174C 'past':57B,164C 'per':116C 'queue':98C,182C 'reach':197C 'repli':5A,38B,45B,93C,103C,114C,122C,132C,176C,192C,196C 'req':150C 'request':187C 'resolv':89C 'return':144C 'right':154C 'rpmb':4A,44B,121C,142C,149C,191C 'scsi':31B,90C,111C,203C 'sens':112C,204C 'setup':97C,181C 'size':178C 'sizeof':188C 'small':8A 'sourc':64B 'space':199C 'state':67B 'storag':28B 'struct':119C,129C,189C 'transport':33B,173C,201C 'uf':3A,27B,42B,101C,120C,130C,185C,190C 'ufs-storag':26B 'ufshcd':147C 'user':198C 'vulner':86C 'write':10A,79B,161C 'written':56B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with UFS storage and the bsg transport using Advanced RPMB commands are the ones the description points at. The sources do not say which kernel versions or hardware are affected, or whether an unprivileged user can trigger the path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99157","severity":null,"published_at":"2026-10-28T11:17:35+00:00","modified_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}