CVE-2026-98479 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.
A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one.
Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire.
Check the direction before using the scatterlist, the way the R2T path already does.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a critical logic flaw within the SCSI initiator transport layer, specifically in the iscsi_tcp_hdr_dissect function of the libiscsi_tcp module. This vulnerability arises from an insufficient validation of data direction when processing iSCSI Protocol Data Units (PDUs). In normal operation, an iSCSI connection involves complex handshakes where commands are issued and responses are returned. The specific flaw occurs in the branch responsible for handling Data-In PDUs, which carry response data back to the initiator from the target storage device. When a Data-In PDU is received, the kernel attempts to resolve the Initiator Task Tag (ITT) to identify the corresponding command task structure. Once identified, it proceeds to copy the payload of that PDU into the scatterlist associated with that original command without verifying whether the original command was intended for reading data or writing data. This oversight stands in stark contrast to other parts of the same module, such as iscsi_tcp_r2t_rsp(), which correctly checks the direction and rejects Receive Ready To Transfer (R2T) PDUs if they do not align with a DMA_TO_DEVICE operation.
The operational impact of this vulnerability is severe due to the potential for memory corruption and data integrity issues. When an iSCSI target maliciously or erroneously responds to a WRITE command ITT with a Data-In PDU, the initiator incorrectly interprets this as valid response data for that write operation. Consequently, the kernel copies the incoming bytes from the network into the scatterlist pages allocated for the original write request. For direct I/O operations using O_DIRECT, these are pinned user-space buffers; overwriting them means the application's own memory is corrupted with arbitrary data supplied by the target. In buffered I/O scenarios, the corruption occurs in page cache structures. While this path may appear quieter initially because standard system calls like pwrite and fsync might still return success codes without immediate kernel panics or log entries, the underlying data integrity is compromised. Subsequent reads from those blocks will retrieve the corrupted target-supplied bytes rather than the intended application data, leading to silent data corruption that can propagate through applications relying on accurate storage inputs.
From a security architecture perspective, this flaw represents a classic case of improper input validation and state machine confusion within kernel memory management routines. The vulnerability allows an attacker with access to the iSCSI target network path to manipulate the initiator's memory layout by injecting crafted PDUs that mismatch the expected command direction. This aligns closely with CWE-20 Improper Input Validation, as the system fails to verify that the incoming data stream matches the context of the active transaction. Furthermore, because this involves manipulating kernel memory structures via network input, it falls under ATT&CK technique T1498 Network Denial of Service if used to crash systems through corruption, or potentially T1059 Command and Scripting Interpreter implications if the corrupted buffers lead to code execution vectors in higher-level applications. The lack of direction checking creates a discrepancy between expected protocol behavior and actual kernel handling, enabling an adversary to achieve unauthorized memory writes under specific conditions.
Mitigation strategies must focus on enforcing strict state validation within the iSCSI stack. Developers should implement immediate checks for data direction before accessing or modifying scatterlist entries associated with any command task structure. Specifically, the code path in iscsi_tcp_hdr_dissect handling Data-In PDUs must verify that the resolved ITT corresponds to a read operation (DMA_FROM_DEVICE) rather than a write operation. If the directions do not match, the PDU should be rejected or logged as an error immediately, preventing any memory copy operations from occurring. This aligns with existing defensive patterns already present in iscsi_tcp_r2t_rsp(). System administrators and users relying on iSCSI storage should ensure their kernel versions are updated to include patches that address this specific logic flaw. Until patched, network segmentation policies restricting access to iSCSI targets can reduce the attack surface by preventing untrusted or compromised hosts from injecting malicious PDUs into the communication stream between initiator and target.