CVE-2026-90293

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IB/isert component where isert put login tx() posts full-feature receive buffers before transport register session() is executed. This allows an initiator that does not wait for the final Login Response to execute a SCSI command against an se session where se tpg is NULL, leading to a system oops at target submit+0xbe. The problem is particularly evident in iWARP environments, which lack RNR (Receiver Not Ready) flow control, causing the connection to terminate upon such a send operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.