All vulnerabilities
CVE-2026-99154

Linux: scsi: libiscsi: Reject a negative task index from parse_pdu_itt

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6cadfa6f1f5896632d4223d3b7addb2a29fea74eAlso 35b60549a956237488c89a2d85352e026e7d55b7, 8ee2a09a1dbb257c9e828ad2497f8e4832dfb142CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 6cadfa6f1f5896632d4223d3b7addb2a29fea74eLinuxCVE List
  • 35b60549a956237488c89a2d85352e026e7d55b7LinuxCVE List
  • 8ee2a09a1dbb257c9e828ad2497f8e4832dfb142LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Reject a negative task index from parse_pdu_itt

A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only:

if (i >= session->cmds_max)

i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array.

be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,

*index = (int)itt;

and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject.

Bound the index from below in both lookups.

Text from CVE List

Affected versions 8

  • Linuxaffected: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb before 6cadfa6f1f5896632d4223d3b7addb2a29fea74eCVE List
  • Linuxaffected: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb before 35b60549a956237488c89a2d85352e026e7d55b7CVE List
  • Linuxaffected: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb before 8ee2a09a1dbb257c9e828ad2497f8e4832dfb142CVE List
  • Linuxaffected: 2.6.33CVE List
  • Linuxunaffected: all versions before 2.6.33CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3