CVE-2026-90413 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: reject login PDUs declaring more data than was received
isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsi_target_locate_portal(),
payload_length = ntoh24(login_req->dlength); tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL);
and for the ones after it in iscsi_decode_text_input(), reached from iscsi_target_do_login().
login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167 __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180 iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370 iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region
Falsifying the second login PDU instead reaches the other reader, on the same buffer:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470 iscsi_target_do_login_rx+0x51d/0x7d0
iscsit over TCP is not exposed: iscsit_get_login_rx() validates the declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the socket, so the declared length governs how much arrives rather than how much is copied out of an already-filled buffer. isert does not call iscsi_target_check_login_request() at all.
Reject a login PDU whose declared DataSegmentLength exceeds what was received, in both paths that reach isert_rx_login_req(): isert_get_login_rx() for the first login PDU and isert_login_recv_done() for the ones after it. dlength <= login_req_len is allowed because the received count can include up to three bytes of iSCSI padding.
Once the check is in place the copy out can no longer exceed the copy in: the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is login_req_len.
Like the existing short-PDU check added by 29e7b925ae6d, the reject in isert_login_recv_done() returns without completing login_req_comp, so a malformed subsequent PDU leaves the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns an error and fails straight away.
Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and 61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run alternately in a single session, and a normal login still completes on the patched build.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's InfiniBand SCSI target driver contains a critical out-of-bounds read vulnerability within its iSCSI login handling logic. This flaw arises from a failure to validate the declared data length in incoming Protocol Data Units against the actual amount of data received by the Host Channel Adapter. Specifically, the function isert_login_recv_done records the number of bytes placed into the login buffer but does not compare this value against the length field specified in the Basic Header Segment of the iSCSI PDU. Consequently, an attacker controlling the initiator side can declare a payload size larger than what was actually transmitted. The kernel code subsequently reads from the fixed-size allocation using this untrusted declared length, leading to memory corruption or information disclosure via out-of-bounds reads before authentication is fully completed.
The technical root cause lies in the discrepancy between how TCP-based iSCSI and RDMA-based iSCSI handle login requests. In standard TCP implementations, the driver validates the declared length against incoming socket data, ensuring that the amount read matches what was received over the network. However, the InfiniBand target implementation bypasses this validation step entirely. When processing the first login PDU in iscsi_target_locate_portal or subsequent PDUs via iscsi_decode_text_input, the system extracts a payload length from the buffer and uses it to duplicate data into a new kernel memory region using kmemdup_nul. Since the underlying buffer has a fixed maximum size of 8192 bytes defined by MAX_KEY_VALUE_PAIRS, declaring a larger value causes the read operation to exceed the allocated slab cache boundary. This results in Kernel Address Sanitizer detecting an out-of-bounds access where the kernel attempts to read more data than was physically present in the buffer provided by the hardware driver.
This vulnerability is classified under CWE-125 as Out-of-Bounds Read, which allows for potential information disclosure or denial of service depending on how the uninitialized memory contents are utilized. From an offensive security perspective, this aligns with ATT&CK technique T1083 File and Directory Discovery if sensitive kernel data is leaked, though it primarily manifests here as a stability issue leading to system crashes. The impact includes local privilege escalation potential if the out-of-bounds read exposes critical kernel structures or leads to use-after-free scenarios during subsequent processing of malformed login sequences. Attackers can exploit this by crafting malicious iSCSI login PDUs that specify excessive data lengths, triggering immediate kernel panics via KASAN reports or potentially exploiting the uninitialized memory for further attacks in unpatched environments.
The resolution involves implementing strict length validation checks within both isert_get_login_rx and isert_login_recv_done functions to ensure that the declared DataSegmentLength does not exceed the actual received byte count. The patch allows a small tolerance of up to three bytes to account for standard iSCSI padding, but strictly rejects any declaration where the payload size surpasses the physical buffer limit. This ensures that subsequent memory copy operations remain within safe bounds and prevents the kernel from accessing unmapped or uninitialized memory regions. By enforcing this constraint early in the login process, the driver maintains integrity during authentication phases and avoids exposing internal kernel states to untrusted network inputs.
Mitigation strategies for administrators involve applying the upstream Linux kernel patch immediately if running affected versions such as 7.2.0-rc4 and earlier. For environments unable to update kernels quickly, restricting access to iSCSI target ports through firewall rules or VLAN segmentation can limit exposure to potential attackers capable of sending crafted RDMA packets. Additionally, enabling Kernel Address Sanitizer in development builds helps detect similar boundary violations early in the software lifecycle before they reach production systems. Regular auditing of network-facing drivers for proper input validation against declared lengths remains essential to prevent out-of-bounds memory access vulnerabilities across all storage protocol implementations.