Executive brief
The Linux kernel's IB/isert (iSER protocol over InfiniBand RDMA) login handler fails to validate that received data matches the length declared in login PDU headers. An attacker can craft a malicious login request declaring more data than actually sent, causing the kernel to read beyond the allocated login buffer. This results in memory disclosure and potential system crash, affecting iSCSI target systems using InfiniBand transport.
Technical details
The vulnerability is a buffer over-read in the IB/isert iSCSI login handling code. The root cause is that isert_login_recv_done() and isert_rx_login_req() do not validate that the DataSegmentLength declared in the login PDU header matches the actual number of bytes received before copying from the fixed 8192-byte login buffer. An unauthenticated remote attacker can send a crafted login PDU declaring a dlength larger than the payload actually transmitted, triggering out-of-bounds reads via kmemdup_nul(). The attack is reachable before authentication and the read length is attacker-controlled. The TCP-based iSCSI variant is not affected because it validates declared lengths against actual received bytes. A patch adding validation of dlength against login_req_len is required to reject PDUs where declared length exceeds received data.
Affected products
- Linux Linux kernel through 7.2.0-rc4 (unpatched)
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory