CVE-2026-72084

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCSI target component where the core scsi3 decode spec i port() and core scsi3 emulate register and move() functions pass a raw PERSISTENT RESERVE OUT parameter buffer to target parse pr out transport id() without specifying the number of valid bytes. For iSCSI TransportIDs, the iscsi parse pr out transport id() function uses an unbounded strstr() to locate the ",i,0x" ISID separator. An initiator can provide a TransportID lacking both the separator and a NUL terminator, causing the scan to read past the end of the buffer. If the parameter list uses a multi-page vmap via transport kmap data sg(), this over-read can hit a vmalloc guard page and cause a system oops. This is reachable via any fabric delivering a PR OUT to a device exported through an iSCSI TPG, including guests using vhost-scsi. Additionally, a malformed descriptor with the separator at the very end can lead to an over-read when core scsi3 locate pr reg() or core scsi3 alloc registration() dereferences the resulting pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.