Executive brief
The Linux kernel's iSCSI target implementation has a buffer-handling flaw in its login processing that allows unauthenticated attackers to read sensitive memory. When an iSCSI initiator sends a specially crafted login request, the kernel fails to properly null-terminate a 8192-byte buffer used to parse authentication credentials, allowing string-processing functions to read beyond the buffer boundary into adjacent memory. This could expose sensitive data from the system.
Technical details
The vulnerability is a missing null-terminator in the login request buffer (req_buf) allocated in iscsi_login_init_conn(). The buffer is allocated with exactly MAX_KEY_VALUE_PAIRS (8192) bytes, but when a login PDU with a DataSegmentLength between 8189–8192 bytes is received (plus padding), no byte is reserved for a NUL terminator. Subsequent string operations (kstrdup, strstr, strlen_semi, and convert_null_to_semi) operate on unterminated data without length bounds, causing out-of-bounds reads into adjacent slab memory. The vulnerability is reachable by an unauthenticated initiator against a portal configured with CHAP authentication. The fix allocates MAX_KEY_VALUE_PAIRS + 1 bytes, allowing kzalloc() to zero the extra byte as a terminator.
Affected products
- Linux Linux kernel All versions prior to patch commit f4825922d2fb371e2b969697d792077f1b62b62c
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-09-11: patched: Patch applied to stable kernel trees by Greg Kroah-Hartman