Executive brief
The Linux kernel's iSCSI library contains a buffer-bounds vulnerability in SCSI response handling that leaks uninitialized connection data (kernel memory) into SCSI sense buffers returned to user applications. An attacker controlling an iSCSI target server can trigger this by sending a specially crafted SCSI response, allowing information disclosure of sensitive kernel memory to userspace applications.
Technical details
The vulnerability exists in iscsi_scsi_cmd_rsp() in drivers/scsi/libiscsi.c, where a bounds check fails to account for a 2-byte sense-length prefix when validating the size of incoming sense data. The vulnerable code checks if datalen >= senselen but then copies from data+2, allowing up to 2 bytes of uninitialized memory to be read beyond the received data segment. An iSCSI target returning a response with datalen equal to senselen (both ≤ SCSI_SENSE_BUFFERSIZE) triggers the read-past-bounds, leaking stale kernel data. The fix adds 2 to the senselen in the bounds check. This affects all Linux kernel versions with libiscsi support.
Affected products
- Linux Linux Kernel all versions with libiscsi support (2.6.11 and later)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-08-09: patched: Fix merged into stable kernel branches