CVE-2026-74557

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iscsi scsi cmd rsp() function where sense data from a SCSI Response is copied from a target-supplied data segment. The segment includes a 2-byte sense length prefix followed by the sense bytes, requiring a total size of 2 + senselen bytes. However, the bounds check only verifies if datalen is greater than or equal to senselen. If a target returns a response where datalen equals senselen, the memcpy() operation reads up to two bytes beyond the received data. This results in stale conn->data contents leaking into the command's sense buffer, which is then returned to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.