ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-90011

scsi: target: iscsi: Reserve a terminator byte for the login payload

Published Sep 16, 2026 · catalog updated Oct 24, 2026 · scsi: target: iscsi: Reserve

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-90011. EPSS is 0.84%. Act only if a listed version of scsi: target: iscsi: Reserve is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (scsi: target: iscsi: Reserve).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.84%
Remediation
Not established
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel3.1.0 → 5.10.270; 5.11.0 → 5.15.221; 5.16.0 → 6.1.188

How to fix CVE-2026-90011

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-90011. EPSS is 0.84%. Act only if a listed version of scsi: target: iscsi: Reserve is installed.

Which versions are affected?

Compare what you have installed with Kernel 3.1.0 → 5.10.270; 5.11.0 → 5.15.221; 5.16.0 → 6.1.188. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.84%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 16, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding b

  2. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.270; Kernel fixed in 5.15.221; Kernel fixed in 6.1.188; Kernel fixed in 6.6.157

  3. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.270; 5.11.0

  4. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding b

Sources

References

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 25, 2026
  • OpenSSF OSV / OSV ScannerOct 25, 2026
  • CVE.orgOct 24, 2026