---
id: "CVE-2026-99157"
kind: "vulnerability"
aliases: ["CVE-2026-99157"]
title: "Linux kernel: UFS RPMB reply buffer too small, heap write overflow"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "linux-kernel", "mobile-hardware", "ufs-storage"]
not_affected_if: ["no-ufs-storage"]
published_at: "2026-10-28T11:17:35+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99157", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux kernel: UFS RPMB reply buffer too small, heap write overflow

The Linux SCSI BSG transport allocates a 96-byte reply buffer, but the UFS Advanced RPMB reply can be 104 bytes, so an extra 8 bytes are written past the end of the buffer. The sources do not state what an attacker can achieve beyond the out-of-bounds write.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Upgrade to a Linux kernel release that includes the upstream commit 'scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies'
- unknown

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99157

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per
job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct
ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command
returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after
the 40-byte header and writes 8 bytes past the end of the buffer.

Let each BSG transport pass its reply buffer size to bsg_setup_queue()
and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full
reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_