Executive brief
The Linux kernel's iblock module, which provides block device support for SCSI target subsystems, contains a logic error in its persistent reservation (PR) operation handling. An attacker with local access or network access to a system using iblock-backed SCSI targets could trigger a NULL pointer dereference by invoking certain PR operations, causing a kernel crash and denial of service.
Technical details
The vulnerability exists in the iblock_execute_pr_out() function in drivers/target/target_core_iblock.c. When handling PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE operations, the code incorrectly checks for the presence of ops->pr_clear (a different callback) instead of checking for ops->pr_preempt and ops->pr_release respectively. This allows execution to proceed when these required callbacks are NULL, leading to a NULL pointer dereference when the unimplemented hooks are invoked. The fix corrects the capability checks to verify the actual hooks that will be called. An attacker with access to issue SCSI PR commands can trigger this crash. Patches have been released in the Linux kernel stable trees.
Affected products
- Linux Linux kernel Multiple versions prior to fix (see git commits 3c60a8b and 9c33222)
Timeline
- 2026-08-28: disclosed: CVE-2026-80691 published
- 2026-07-24: patched: Upstream fix committed (9c33222)
- 2026-08-09: patched: Stable tree fix committed (3c60a8b)