Executive brief
A vulnerability in the Linux kernel's iSCSI target implementation could allow a remote attacker to cause a system crash or potentially execute unauthorized code. The issue occurs during the login phase when the system handles specially crafted connection requests, leading to a memory overflow. This affects servers providing iSCSI storage services, potentially impacting data availability and system stability.
Technical details
A heap buffer overflow exists in the Linux kernel's iSCSI target subsystem (iscsit). The function iscsi_encode_text_output() uses sprintf() to concatenate "key=value" records into an 8192-byte response buffer (login->rsp_buf) without verifying remaining capacity. While input PDU size is capped at 8KB, an attacker can send a PDU with many small, unknown keys. Each unknown key triggers a 16-byte "NotUnderstood" response, allowing an attacker to generate up to 32KB of output, resulting in a ~24KB overflow of the kmalloc-8k slab. This can be triggered remotely during the PHASE_SECURITY or PHASE_OPERATIONAL login stages without prior authentication. The fix replaces sprintf() with snprintf() and implements explicit bounds checking.
Affected products
- Linux Linux Kernel v4.1 to v7.1-rc2
Timeline
- 2026-05-11: other: Patch submitted by Michael Bommarito
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db
- https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3
- https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b
- https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a
- https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627
- https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c
- https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39