CVE-2026-90011

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iSCSI target implementation where the iscsi target check login request() function fails to reserve a NUL terminator byte for the login payload buffer. When a login PDU has a DataSegmentLength between 8189 and 8192 bytes, the login->req buf buffer is completely filled, leaving no space for a terminator. This leads to an out-of-bounds read when the buffer is processed as a C string in the CHAP (Challenge-Handshake Authentication Protocol) path. Specifically, functions such as chap check algorithm(), extract param(), and strlen semi() may read past the end of the object into adjacent slab memory. This is reachable by an unauthenticated initiator targeting a portal configured for CHAP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.