CVE-2026-90413

Status: UPDATED  |  Advisory ID: CVE-2026-90413

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: reject login PDUs declaring more data than was received

isert_login_recv_done() records how many bytes the HCA actually placed in

the login buffer, but nothing compares that against the length the login

PDU's BHS declares. isert_rx_login_req() copies min(login_req_len,

MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then

reads the declared length back out of that buffer - for the first PDU in

iscsi_target_locate_portal(),

payload_length = ntoh24(login_req->dlength);

tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL);

and for the ones after it in iscsi_decode_text_input(), reached from

iscsi_target_do_login().

login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so

an initiator that declares more than it sends reads off the end of it,

before authentication and with the length under its control:

BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80

Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167

__asan_memcpy+0x23/0x60

kmemdup_nul+0x43/0x80

iscsi_target_locate_portal+0x48d/0x1180

iscsi_target_login_thread+0x19a9/0x3350

Allocated by task 167:

__kmalloc_cache_noprof+0x158/0x370

iscsi_target_login_thread+0x971/0x3350

which belongs to the cache kmalloc-8k of size 8192

allocated 8192-byte region

Falsifying the second login PDU instead reaches the other reader, on the

same buffer:

BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80

Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50

Workqueue: isert_login_wq iscsi_target_do_login_rx

__asan_memcpy+0x23/0x60

kmemdup_nul+0x43/0x80

iscsi_decode_text_input+0xc6/0x11c0

iscsi_target_do_login+0x261/0x1470

iscsi_target_do_login_rx+0x51d/0x7d0

iscsit over TCP is not exposed: iscsit_get_login_rx() validates the

declared length with iscsi_target_check_login_request() and then reads

exactly that many bytes off the socket, so the declared length governs

how much arrives rather than how much is copied out of an already-filled

buffer. isert does not call iscsi_target_check_login_request() at all.

Reject a login PDU whose declared DataSegmentLength exceeds what was

received, in both paths that reach isert_rx_login_req():

isert_get_login_rx() for the first login PDU and isert_login_recv_done()

for the ones after it. dlength <= login_req_len is allowed because the

received count can include up to three bytes of iSCSI padding.

Once the check is in place the copy out can no longer exceed the copy in:

the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot

exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is

login_req_len.

Like the existing short-PDU check added by 29e7b925ae6d, the reject in

isert_login_recv_done() returns without completing login_req_comp, so a

malformed subsequent PDU leaves the login to be torn down by the login

timer rather than failing immediately. The first-PDU path returns an

error and fails straight away.

Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an

initiator that sends the real key=value payload while declaring 8193 in

the BHS, on the first login PDU and on the second in separate runs. The

reported read size tracks the declared value exactly; 16384 and 61440

behave the same. Unpatched 3 of 3 runs report on each of the two paths,

patched 0 of 3 on both, run alternately in a single session, and a normal

login still completes on the patched build. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References