CVE-2026-99153

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU

A Reject PDU carries a copy of the header it rejects, and iscsi handle reject() takes the ITT out of that copy to find the task to clean up:

memcpy(&rejected pdu, data, sizeof(struct iscsi hdr)); ... task = iscsi itt to task(conn, rejected pdu.itt);

That value is whatever the target put there. iscsi itt to task() bounds the index against cmds max and checks nothing else, so any task in the pool can be named, and iscsi nop out rsp() then completes it.

An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi complete task() hits its WARN ON ONCE(task->state == ISCSI TASK FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning.

Validate the reflected ITT the way iscsi itt to ctask() validates a command ITT, and require the task to be in flight and not a SCSI command.

[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi nop out rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] [ 6.255768] iscsi complete pdu+0x18bf/0x22a0 [ 6.256733] iscsi complete pdu+0x54/0xa0 [ 6.256905] iscsi tcp data recv done+0xf4/0x250 [ 6.257103] iscsi tcp recv skb+0x31e/0xec0 [ 6.257680] iscsi sw tcp recv+0x12f/0x390 [ 6.258061] tcp read sock+0x1ab/0x810 [ 6.258853] iscsi sw tcp data ready+0x18b/0x510 [ 6.259808] tcp data queue+0x1f13/0x4cd0 [ 6.260567] tcp rcv established+0x8a5/0x3a00 [ 6.261931] tcp v4 do rcv+0x449/0x960 [ 6.262269] tcp v4 rcv+0x2245/0x3bc0