All vulnerabilities
CVE-2026-98479

Linux: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in79991b770fc3685b1d5cf805b659a879edd19931Also 8db1232945bc663fb94f300090a1fc108de99296, 94e5bdd08e51c450d954bc592f591c233ca5c9df and 1 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 79991b770fc3685b1d5cf805b659a879edd19931LinuxCVE List
  • 8db1232945bc663fb94f300090a1fc108de99296LinuxCVE List
  • 94e5bdd08e51c450d954bc592f591c233ca5c9dfLinuxCVE List
  • 24ffc919467d20951f0f132d1c75294e2e91e09bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.

A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one.

Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire.

Check the direction before using the scatterlist, the way the R2T path already does.

Text from CVE List

Affected versions 18

  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before 79991b770fc3685b1d5cf805b659a879edd19931CVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before 8db1232945bc663fb94f300090a1fc108de99296CVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before 94e5bdd08e51c450d954bc592f591c233ca5c9dfCVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before de96dc11aee0d058927bff94a168e3c5c46483e2CVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before e3b25bf2cf2496e85bc05b33360faf9fdf880e03CVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before ee56b5e18f566c0b5a183379dcd63d402cebf2f8CVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before 24ffc919467d20951f0f132d1c75294e2e91e09bCVE List
  • Linuxaffected: a081c13e39b5c17052a7b46fafa61019c4c110ff before bce07e2f37b5e4a427d36fd6b1c14067b27591dbCVE List
  • Linuxaffected: 2.6.29CVE List
  • Linuxunaffected: all versions before 2.6.29CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8