Executive brief
The Linux kernel's InfiniBand iSER transport layer has a race condition where full-feature receive buffers are posted before a session is properly registered. An attacker exploiting this can send SCSI commands against an uninitialized session, causing a kernel crash or potential code execution on systems using InfiniBand or RoCE storage networks.
Technical details
The vulnerability is a race condition in the IB/isert (InfiniBand iSER Transport) subsystem where isert_put_login_tx() posts receive buffers before __transport_register_session() completes. An attacker (or a non-compliant initiator) that sends a SCSI command before receiving the final Login Response can trigger a null pointer dereference in target_submit() when se_tpg is NULL. The fix moves buffer posting from isert_put_login_tx() to isert_get_rx_pdu() after session registration. The attack vector requires network access to an iSER target and a malicious or non-standard iSER initiator; exploitation was observed in testing (5-8 crashes out of 10 attempts) and is confirmed reproducible.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched