open-iscsi CVE-2026-44944

open-iscsi is the standard Linux iSCSI initiator stack; iscsiuio is its companion userspace daemon that drives hardware iSCSI offload engines (Broadcom/QLogic bnx2i/cnic) and manages network configuration on behalf of the kernel, typically running as root. The daemon exposes a Unix control socket and is supposed to authorize only the root user via mgmt_peeruser(). The commit diff in iscsiuio/src/unix/iscsid_ipc.c shows the root cause: the peer-credential check was performed against the listening socket (iscsid_opts.fd) instead of the newly accepted per-connection socket (s2), so the SO_PEERCRED identity of the actual client was never checked. Additionally, a failed check called break (tearing down the accept loop) rather than continue (rejecting just that one client). The same patch also hardens iSNS/firmware discovery paths with a new iqn_name_valid() IQN validator implementing RFC 3722 prohibited-character checks, but the core CVE is the incorrect peeruser comparison.