CVE-2026-99153 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up:
memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt);
That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it.
An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning.
Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command.
[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
[ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
[ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160
[ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00
[ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206
[ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25
[ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060
[ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504
[ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000
[ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000
[ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000
[ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0
[ 6.255439] PKRU: 55555554
[ 6.255564] Call Trace:
[ 6.255674] <IRQ>
[ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0
[ 6.256733] iscsi_complete_pdu+0x54/0xa0
[ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250
[ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0
[ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390
[ 6.258061] __tcp_read_sock+0x1ab/0x810
[ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510
[ 6.259808] tcp_data_queue+0x1f13/0x4cd0
[ 6.260567] tcp_rcv_established+0x8a5/0x3a00
[ 6.261931] tcp_v4_do_rcv+0x449/0x960
[ 6.262269] tcp_v4_rcv+0x2245/0x3bc0
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel's SCSI subsystem contains a critical input validation flaw within the iSCSI protocol implementation, specifically in the handling of Reject Protocol Data Units. This vulnerability arises from insufficient verification of the Initiator Task Tag (ITT) field contained within an incoming Reject PDU sent by an iSCSI target device. When the kernel receives such a packet, it extracts the ITT to identify and clean up the corresponding task structure associated with that command. However, the function iscsi_handle_reject() fails to adequately validate this reflected ITT value before attempting to locate the relevant task object in the connection's command pool. This lack of rigorous bounds checking allows an attacker or a misbehaving target to supply arbitrary values for the ITT field, potentially referencing memory locations that do not correspond to valid, active tasks.
The technical root cause lies in the iscsi_itt_to_task() function, which performs basic index boundary checks against cmds_max but omits deeper state validation. Consequently, if an attacker provides a crafted ITT value pointing to an unused slot or one belonging to a previously completed task, the kernel proceeds with operations on invalid data structures. In scenarios where the referenced task has never been allocated for the current session, the conn pointer within the task structure remains NULL because memory pools are zeroed during session setup and only populated upon allocation. Accessing this null pointer triggers a general protection fault, leading to a kernel panic or system crash as evidenced by KASAN reports indicating null-pointer dereferences in iscsi_nop_out_rsp(). This represents a classic case of improper input validation where external data influences internal control flow without adequate sanitization.
Furthermore, the vulnerability extends beyond simple denial-of-service through crashes. If the crafted ITT references a task that was previously used and returned to the free pool, the kernel may incorrectly complete an in-flight SCSI command as successful. This occurs because iscsi_complete_task() might hit warning conditions related to reference counting underflows or state mismatches, but more critically, it can result in data integrity issues where large read operations are reported as completed successfully without actually writing any buffer content. Such behavior compromises the reliability of storage systems relying on iSCSI for block-level access, potentially leading to silent data corruption or loss if applications assume successful completion implies valid data retrieval. This aligns with CWE-20 Improper Input Validation and CWE-190 Integer Overflow or Wraparound in contexts where index calculations are not strictly bounded by operational state.
From a threat modeling perspective, this vulnerability maps to MITRE ATT&CK technique T1498 Network Denial of Service if exploited for crashes, or potentially data manipulation vectors if the silent completion issue is leveraged effectively against specific application logic. The attack vector requires network access to an iSCSI target that supports sending Reject PDUs with arbitrary ITT values, making it a remote exploit scenario in environments where trust boundaries between hosts and storage arrays are not strictly enforced at the protocol level. Attackers could potentially use this flaw to disrupt availability by crashing the host kernel or to introduce subtle data integrity errors that evade immediate detection due to the lack of explicit error codes for certain failure modes.
Mitigation strategies primarily involve applying vendor-provided kernel patches that enforce stricter validation on ITT values within Reject PDUs. The fix requires validating the reflected ITT similarly to how iscsi_itt_to_ctask() validates command ITTs, ensuring the task exists and is currently in flight rather than free or completed. Administrators should ensure their systems are updated with the latest stable kernel versions that include these corrections. Additionally, implementing network-level controls such as firewalls to restrict iSCSI traffic to trusted targets can reduce exposure until patches are deployed. Regular auditing of storage logs for unexpected task completions or null-pointer exceptions in dmesg outputs is also recommended to detect potential exploitation attempts early.