A vulnerability in the Linux kernel's SCSI UFS core bsg subsystem could cause a crash when the arpmb command fails. This occurs because the kernel attempts to copy user data even if the device does not support arpmb, leading to a crash in bsg_transport_sg_io_fn(). The issue is triggered when ufs_bsg_exec_advanced_rpmb_req() returns an error but the job's reply length is still set.