CVE-2026-90011

Status: UPDATED  |  Advisory ID: CVE-2026-90011

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Reserve a terminator byte for the login payload

iscsi_target_check_login_request() rejects a login PDU whose

DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and

login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS

bytes. Since iscsit_get_login_rx() receives payload_length + padding

bytes, where

padding = ((-payload_length) & 3);

any payload_length from 8189 to 8192 fills the whole 8192 byte

buffer. The write stays in bounds, but no byte is left for a NUL

terminator.

The buffer is subsequently consumed as a C string. In the CHAP path

chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls

strstr(in_buf, pattern) followed by strlen_semi(), none of which take a

length. convert_null_to_semi() additionally rewrites every embedded NUL

to ';', so even a payload made of well formed NUL separated key=value

records is left without a terminator. These walk past the end of the

object into adjacent slab memory. It is reachable by an unauthenticated

initiator against a portal configured for CHAP; when authentication is

not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and

the CHAP path is never entered.

Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to

it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS

bytes, so the buffer is always terminated. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References