CVE-2026-80691 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer.
Check whether the hooks that need to be called are supported.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the Linux kernel's SCSI target subsystem within the iblock driver represents a critical logic flaw involving improper validation of function pointers prior to execution. Specifically, the issue resides in the iblock_execute_pr_out() function, which handles Persistent Reservation operations for block devices backed by host block storage. The affected operation codes include PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE. These operations are designed to manage access control and reservation states for shared storage resources, a mechanism crucial for high-availability clusters where multiple hosts may attempt to access the same logical unit simultaneously.
The core technical flaw stems from an insufficient NULL check performed on the ops->pr_clear member of the operation structure. In C programming, particularly within kernel space, dereferencing a function pointer that holds a null value results in a segmentation fault or general protection fault, leading to an immediate kernel panic and system crash. The original code logic erroneously allowed unimplemented hooks to pass through validation gates. This means that if a specific storage backend did not implement the pr_clear callback, the driver would proceed to invoke it without verifying its existence. Consequently, any attempt by a user-space application or initiator to execute these persistent reservation operations against such an unsupported configuration triggers a null pointer dereference.
From a security and operational impact perspective, this vulnerability is classified as a denial of service condition due to system instability. An attacker with the ability to send SCSI commands to the target device can exploit this flaw by issuing PREEMPT or RELEASE commands. Since these operations are often accessible via standard management interfaces or through compromised initiators in a storage area network environment, the attack vector is relatively straightforward. The successful exploitation results in the immediate termination of the kernel process handling the I/O stack, causing downtime for all services relying on that host and potentially disrupting access to shared storage resources for other nodes in the cluster.
This flaw aligns with CWE-476, which describes a NULL Pointer Dereference vulnerability. It also relates to CWE-20, Improper Input Validation, as the system failed to adequately validate the capabilities of the underlying block device driver before attempting to utilize specific features. In terms of adversarial tactics, this could be leveraged within the MITRE ATT&CK framework under techniques related to Impact or Defense Evasion, specifically by causing service disruption through resource exhaustion via crash induction.
Mitigation strategies primarily involve applying kernel patches that correct the validation logic in iblock_execute_pr_out(). The fix ensures that before any callback is invoked, the code explicitly checks whether the corresponding function pointer is non-null and supported by the current backend implementation. Administrators should ensure their systems are updated with the latest stable kernel versions containing this patch. Additionally, when configuring SCSI target backends, it is prudent to verify driver support for persistent reservation operations if such features are required in production environments, thereby avoiding configurations that might trigger unsupported code paths until patches are applied.