CVE-2026-74556 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's iSCSI implementation, specifically in the libiscsi_tcp subsystem that handles TCP-based iSCSI communications. The issue stems from an inconsistent approach to buffer management when processing different types of iSCSI Protocol Data Units (PDUs). The kernel maintains a fixed-size connection buffer named conn->data with a capacity of ISCSI_DEF_MAX_RECV_SEG_LEN bytes, which is set to 8192 bytes by default. This buffer serves as the destination for data segments from various PDU types received over the iSCSI connection.
The technical flaw manifests in how the iSCSI protocol handles different response opcodes during the dissect process. While the implementation correctly validates and bounds data segment lengths for LOGIN_RSP, TEXT_RSP, REJECT, and ASYNC_EVENT PDUs, it fails to apply the same validation mechanism to SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) operations. This inconsistency creates a potential buffer overflow scenario where a target device can send SCSI response data that exceeds the 8192-byte fixed buffer capacity. The vulnerability is particularly concerning because the maximum receive data length is negotiated between initiator and target, with common default values like open-iscsi's 262144 bytes far exceeding the buffer limit.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a potential vector for denial-of-service attacks or arbitrary code execution within the kernel space. When an iSCSI target returns a SCSI response with data segment length between 8193 and the negotiated maximum receive length, the kernel's buffer management fails to prevent the overflow. This condition violates fundamental security principles outlined in CWE-121, which addresses stack-based buffer overflow conditions where insufficient bounds checking allows attackers to overwrite adjacent memory locations. The vulnerability affects systems running Linux kernels with iSCSI implementations that utilize the libiscsi_tcp subsystem, potentially compromising the stability and integrity of storage communications.
The mitigation strategy involves implementing consistent buffer validation across all PDU response types by incorporating the SCSI command response opcode into the existing validation logic group. This approach ensures that all data segments, regardless of their type, are subject to the same bounds checking mechanism that already protects other response types. The fix requires modifying the iscsi_tcp_hdr_dissect() function to apply the same data segment length validation that currently exists for LOGIN_RSP, TEXT_RSP, REJECT, and ASYNC_EVENT operations to ISCSI_OP_SCSI_CMD_RSP responses as well. This remediation aligns with established security practices in the ATT&CK framework under the T1059 technique category for command execution, as it prevents potentially malicious data from causing buffer overflows that could lead to privilege escalation or system compromise. The implementation should maintain backward compatibility while strengthening the kernel's defensive mechanisms against malformed iSCSI responses that could otherwise exploit this memory corruption vulnerability.