CVE-2026-90293 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: post the full-feature receive buffers after session registration
isert_put_login_tx() posts the full-feature receive buffers before __transport_register_session() runs, so an initiator that does not wait for the final Login Response can still have a SCSI command executed against an se_session whose se_tpg is NULL - the same oops as the previous patch, at target_submit+0xbe.
Post them from isert_get_rx_pdu(), which the previous patch already uses to send that response, and post them before that send: the receive queue is filled at the moment the initiator is told it may use it. Allocating there keeps the existing property that a memory allocation failure cannot happen once the final Login Response is on the wire.
The receive queue is already empty between the final Login Request and isert_post_recvm(); this moves the second point later, from a median of 92 us to 172 us over 1200 logins. Only an initiator that sends before it has been told to can reach that window, and on IB and RoCE its send is retried there until the buffers appear - isert_rdma_accept() asks for rnr_retry_count = 7. iWARP has no RNR flow control, so there the same send terminates the connection instead.
Measured over rxe, 400 login cycles per run, with an initiator that does not wait: an instrumented build counted no entries to isert_recv_done() before the buffers are posted in 10 runs, where that initiator oopsed 8 of 10 unpatched runs and 5 of 10 with only the previous patch.
Not tested: iWARP, discovery sessions over iSER, and real HCAs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's InfiniBand SCSI target driver contains a race condition vulnerability related to session registration and buffer posting that can lead to a system crash or denial of service. This issue arises from the specific sequence in which receive buffers are posted relative to the transport layer session registration process. Specifically, the function isert_put_login_tx() posts full-feature receive buffers before __transport_register_session() completes its execution. This timing creates a critical window where an initiator that does not strictly wait for the final Login Response can attempt to execute SCSI commands against an se_session object whose target portal group (se_tpg) pointer remains NULL. Accessing or operating on this uninitialized state triggers a kernel oops, effectively crashing the system or disrupting services provided by the storage subsystem.
From a technical perspective, the flaw is rooted in improper synchronization between network protocol states and internal driver data structures. The vulnerability allows an initiator to bypass standard waiting mechanisms inherent in the iSCSI over InfiniBand (iSER) protocol stack. By sending commands before receiving confirmation that the session is fully established and buffers are ready, the attacker exploits a race condition where the kernel attempts to process I/O requests against invalid memory references or null pointers within the target submission path. This results in a crash at target_submit+0xbe, indicating a failure during the initial stages of command processing when critical context data has not yet been properly initialized by the transport layer registration routine.
The operational impact of this vulnerability is significant for systems relying on iSER storage connectivity. A successful exploitation allows an unauthenticated or malicious initiator to cause a kernel panic simply by sending SCSI commands prematurely during the login phase. This constitutes a denial of service against the host system and potentially disrupts access to shared storage resources for other legitimate initiators connected to the same target portal group. The vulnerability is particularly relevant in environments where network latency or aggressive client implementations might lead to early command submission, although it requires specific conditions such as an initiator that does not adhere strictly to waiting for the Login Response before sending data.
To mitigate this risk, the kernel maintainers have implemented a fix that alters the timing of buffer posting. The solution involves moving the post operation from isert_put_login_tx() to isert_get_rx_pdu(). This change ensures that receive buffers are posted only after the session registration process has sufficiently progressed and immediately before sending the final Login Response. By aligning the availability of receive queues with the explicit notification sent to the initiator, the window for exploitation is eliminated. The fix also maintains the property that memory allocation failures cannot occur once the final response is transmitted, ensuring stability under load. Performance measurements indicate a slight increase in latency between login request and buffer posting, but this trade-off ensures correctness and prevents crashes caused by premature command execution.
This vulnerability aligns with CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as it involves a race condition where shared resources are accessed without proper synchronization of state transitions. Additionally, the attack vector relates to improper input validation or handling during protocol negotiation phases, which can be mapped to ATT&CK techniques involving resource hijacking or denial of service through exploitation of software vulnerabilities. System administrators should ensure that kernel updates incorporating this fix are applied promptly to prevent potential crashes in production storage environments utilizing InfiniBand and RoCE adapters for iSER connectivity.