Executive brief
A vulnerability was identified in the Linux kernel's Chelsio FCoE offload driver (csiostor). This issue occurs when the system attempts to handle a storage reset under specific error conditions, potentially leading to a system crash (kernel panic). While this primarily affects system availability, it requires local access to the system to trigger.
Technical details
A null pointer dereference exists in the 'csiostor' SCSI driver within the 'csio_eh_lun_reset_handler' function in 'drivers/scsi/csiostor/csio_scsi.c'. The vulnerability is triggered during an error exit path when the remote node pointer 'rn' is NULL; the code subsequently attempts to use the 'CSIO_INC_STATS' macro on this NULL pointer. This results in a kernel oops/panic. The fix introduces a new error return label ('fail_ret') that bypasses the statistics increment macro when 'rn' is NULL. The issue has been patched in multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel All versions prior to the fix in the csiostor driver
Timeline
- 2026-01-29: other: Patch authored by Colin Ian King
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/16ccbfddcb32365138c806cf572e69b42a193c5c
- https://git.kernel.org/stable/c/1982257570b84dc33753d536dd969fd357a014e9
- https://git.kernel.org/stable/c/25ab5e97d3c5f3ed594b4a65d1cc99dc24756681
- https://git.kernel.org/stable/c/25d623f0d77c11a256a54e860d00c239aa9a2583
- https://git.kernel.org/stable/c/3bbbab7b6949c76df64210348adbefedaabbf549
- https://git.kernel.org/stable/c/44ef9f81392de885883f73b9f5c43936a82ae9d7
- https://git.kernel.org/stable/c/526ea3c0ccd495b0079db3e28fdddd51c1bf01f7