Executive brief
The Linux kernel's iSCSI TCP driver contains a buffer overflow vulnerability in how it processes SCSI Command Response packets from storage targets. A malicious or compromised storage target can send a specially crafted response that overflows an 8KB internal buffer, potentially allowing remote code execution or denial of service on systems using iSCSI storage.
Technical details
A stack buffer overflow exists in the libiscsi_tcp driver's iscsi_tcp_hdr_dissect() function. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) opcode handler copies sense/response data into a fixed 8192-byte buffer (ISCSI_DEF_MAX_RECV_SEG_LEN) via iscsi_tcp_data_recv_prep() without validating the data segment length. While other response opcodes (LOGIN_RSP, TEXT_RSP, REJECT, ASYNC_EVENT) enforce this boundary, SCSI_CMD_RSP did not. The only upstream limit was conn->max_recv_dlength (MaxRecvDataSegmentLength), commonly negotiated above 8192 bytes (open-iscsi defaults to 262KB). An attacker controlling an iSCSI target can craft a response with a DataSegmentLength between 8193 and max_recv_dlength to trigger buffer overflow. The fix applies the same boundary check to SCSI_CMD_RSP as other response types. This requires network access to an iSCSI target; no authentication is needed for the malicious response itself.
Affected products
- Linux Linux kernel Linux 2.6.11 through 7.2 (affected versions include 2.6.x, 3.x, 4.x, 5.x, 6.x, and 7.x series prior to patch c1dea15f819cded9b3faf58f8bec72323568b6e6)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-08-09: patched: Patch committed by Greg Kroah-Hartman; upstream commit c1dea15f819cded9b3faf58f8bec72323568b6e6