CVE-2026-90294

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IB/isert component where the isert put login tx() function sends the final Login Response before the session is registered via transport register session(). If an initiator issues a SCSI command immediately upon receiving this response, the command may be executed against an se session where the se tpg variable is still NULL. This leads to a NULL pointer dereference, causing the ib-comp-wq worker to crash (oops). A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, which is an invalid operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.