CVE-2026-99154
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a…
- Risk score
- 75/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Linux kernel's scsi: libiscsi module allows an attacker to read memory before the array, potentially leading to a critical security issue. An attacker could exploit this vulnerability to gain high privileges, read, modify or delete data, or disrupt services.
- Affected
- {'products': ['Linux kernel'], 'packages': [], 'versions': ['affected by scsi: libiscsi module']}
- Fix
- Check the linked advisory for the fix, as the record does not specify a version or detail.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: linux kernel
References
- https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7
- https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e
- https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142
- https://git.kernel.org/stable/c/0eb06ebbbecb122f0df9a1f7f623f5255be741ed
- https://git.kernel.org/stable/c/24bd9ba431b2daa263f3551bc2f09f6b4487f5ae
- https://git.kernel.org/stable/c/6200fb2de579f268742a77b0f3d823cb0a8b1947
- https://git.kernel.org/stable/c/e896a97f336c5edfc13066b57ed431cb3f64e68c
- https://git.kernel.org/stable/c/f8fabe1fe044f86abc42194b8f86dfd70212115f
Original description
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups.
Last activity 28 Oct 2026. Patch Forecast updates every hour.