CVE-2026-99154

Status: UPDATED  |  Advisory ID: CVE-2026-99154

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Reject a negative task index from parse_pdu_itt

A transport that implements parse_pdu_itt hands libiscsi an index taken

from the PDU, and both lookups bound it from above only:

if (i >= session->cmds_max)

i and cmds_max are both int, so a negative index passes and

session->cmds[i] is read from before the array.

be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,

*index = (int)itt;

and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the

hardware async ring without replacing its ITT, so the value is the

target's. It also reports the session's own age rather than the one in

the tag, which leaves the age comparison in iscsi_verify_itt() with

nothing to reject.

Bound the index from below in both lookups. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References