Executive brief
A vulnerability in the Linux kernel's SCSI target subsystem could allow a local user to read sensitive information from the system's memory or cause a system crash. The issue occurs when the system processes long storage identifiers, which can overflow internal buffers used for displaying configuration data. This could lead to the exposure of kernel memory contents or trigger a security panic that halts the system.
Technical details
A stack-based buffer over-read exists in the target_tg_pt_gp_members_show() function within drivers/target/target_core_configfs.c. The function uses snprintf() to format LUN paths into a 256-byte stack buffer. Because snprintf() returns the length the string would have been (which can exceed the buffer size when processing long iSCSI IQN names), a subsequent memcpy() operation uses this unbounded length. This results in reading past the stack buffer and copying adjacent stack contents to the sysfs reader. On systems with CONFIG_FORTIFY_SOURCE enabled, this triggers a fortify_panic(), leading to a denial of service. The issue has been resolved by adding proper bounds checking to the snprintf() return value.
Affected products
- Linux Linux Kernel v4.0.0-rc6 and later
Timeline
- 2026-05-28: advisory: CVE-2026-46149 published by NVD
- 2026-05-14: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/00d91bfdce5033f5d9b4915638ae9b0553848b5d
- https://git.kernel.org/stable/c/1f678d13e939f91840cb1ebe9b88544923539d3c
- https://git.kernel.org/stable/c/72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e
- https://git.kernel.org/stable/c/772a896a56e0e3ef9424a025cec9176f9d8f4552
- https://git.kernel.org/stable/c/e501154f9d82c95d2719bcbbaf679d8fd3226ef7