Heap-based buffer overflow in Linux kernel - CVE-2026-99157

Vulnerability details

The vulnerability allows a local user to corrupt kernel heap memory, potentially causing a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel BSG reply handling when processing UFS Advanced RPMB commands that return an EHS. A local user can trigger processing of such a command to cause ufshcd_advanced_rpmb_req_handler() to write a 104-byte reply, consisting of a 40-byte header and a 64-byte EHS, into a 96-byte heap buffer, corrupting eight bytes beyond its boundary and potentially causing a denial of service.

Affected software

How to mitigate CVE-2026-99157

External References

• https://git.kernel.org/stable/c/2effbe746452c108188f85a6951f2b0b65653840
• https://git.kernel.org/stable/c/7a755f6d47b811d3abd93c1642ce5e63894540b8
• https://git.kernel.org/stable/c/ec6b083915e8146e147314a5f4f1285d07b57bfc

Related Security Bulletins

• Heap-based buffer overflow in Linux kernel BSG reply buffer allocation in block/bsg-lib.c and ufshcd_advanced_rpmb_req_handler() in the UFS BSG command handling path
• Debian update for linux