CVE-2026-74556

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the libiscsi tcp component where the iscsi tcp hdr dissect() function handles data segments for various Protocol Data Unit (PDU) types. While most opcodes are validated against the fixed-size conn->data buffer of 8192 bytes, the SCSI Command Response (ISCSI OP SCSI CMD RSP) path copies its data segment into the same buffer via iscsi tcp data recv prep() without performing this check. Because the bound is instead based on conn->max recv dlength, which is often negotiated to be much larger than 8192 bytes, a target returning a SCSI Response with a DataSegmentLength between 8193 and max recv dlength can cause a buffer overflow in conn->data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.