The Linux kernel's SCSI subsystem contains an out‑of‑bounds write when processing Advanced RPMB replies. The bsg library allocates a 96‑byte buffer, but the actual reply occupies 104 bytes, causing 8 bytes beyond the buffer to be overwritten. This overflow can corrupt kernel memory and enable local privilege escalation if an attacker can send a crafted RPMB command.

All Linux kernel releases that use the bsg‑lib before the patch commits 2effbe746452c108188f85a6951f2b0b65653840, 7a755f6d47b811d3abd93c1642ce5e63894540b8, and ec6b083915e8146e147314a5f4f1285d07b57bfc. The vulnerability affects the SCSI BSG transport used by UFS devices and can impact any system that employs that transport without the patch.

The CVSS base score is not provided and EPSS is unavailable, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. The attack requires local access to the UFS device and the ability to issue a malformed rpm‑b command. Because the overflow occurs in kernel mode, an exploit could lead to privilege escalation to root if successfully triggered.