CVE-2026-90011 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Reserve a terminator byte for the login payload
iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where
padding = ((-payload_length) & 3);
any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator.
The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a critical out-of-bounds read vulnerability within the iSCSI target implementation, specifically affecting how login payloads are processed and consumed as C strings. The flaw originates in the scsi:target:iscsi subsystem where the function iscsi_target_check_login_request validates incoming Login Protocol Data Units by checking if the DataSegmentLength exceeds a defined maximum limit of MAX_KEY_VALUE_PAIRS bytes. While this check prevents buffer overflows during the initial allocation phase, it relies on an incorrect comparison operator that allows payloads with lengths up to exactly 8192 bytes to pass validation when the allocated buffer size is also 8192 bytes. This discrepancy arises because the kernel allocates memory for MAX_KEY_VALUE_PAIRS but fails to reserve space for a mandatory NUL terminator, which is essential for safe string manipulation in C-based systems.
The operational impact of this vulnerability is severe due to how subsequent functions handle the received data. The function iscsit_get_login_rx receives payload length plus padding bytes calculated using bitwise operations that can result in total lengths reaching 8192 bytes when the original payload length falls between 8189 and 8192. Although these writes remain within the allocated memory bounds, they completely fill the buffer without leaving any room for a terminating NUL byte. Consequently, when this data is passed to functions that treat it as a standard C string, such as chap_check_algorithm which invokes kstrdup, or extract_param which uses strstr and strlen_semi, the code reads past the end of the allocated object into adjacent slab memory. This behavior constitutes an out-of-bounds read vulnerability classified under CWE-126 Buffer Over-read, allowing potential information disclosure or kernel instability depending on what data resides in the neighboring memory regions.
The exploitability of this flaw is contingent upon specific configuration states within the iSCSI target portal. The vulnerable code path involving CHAP authentication checks is only reachable when a portal is configured to require Challenge-Handshake Authentication Protocol (CHAP) credentials. In scenarios where authentication is disabled or set to None, the function iscsi_login_zero_tsih_s2 modifies the AuthMethod field and bypasses the CHAP verification logic entirely, thereby avoiding the vulnerable string processing routines. However, for environments enforcing strict access controls via CHAP, an unauthenticated initiator can craft a malicious login request with carefully sized payload data to trigger this out-of-bounds read condition during the authentication handshake process.
To mitigate this vulnerability, developers have implemented a fix that allocates one additional byte beyond MAX_KEY_VALUE_PAIRS using kzalloc, which ensures zero-initialization of memory. This extra byte serves as a guaranteed NUL terminator since all write operations are constrained to copy data only up to offset 0 for at most the original maximum length, leaving the final byte untouched and set to zero by the kernel's allocation routine. This structural adjustment aligns with secure coding practices recommended in CWE-134 Use of Externally-Controlled Format String or CWE-787 Out-of-bounds Write prevention strategies, ensuring that string operations always encounter a valid termination character regardless of input length variations caused padding calculations. Security practitioners should ensure their Linux kernels are updated to include this patch and verify that iSCSI targets requiring CHAP authentication have applied the corresponding kernel updates to prevent potential memory corruption or information leakage attacks.