Linux Kernel CVE-2026-74556

Exploitation requires the victim Linux host to act as an iSCSI initiator (open-iscsi/libiscsi_tcp over TCP) and to establish a session with an attacker-controlled or compromised iSCSI target, or an attacker who can interpose on the initiator-target TCP connection. The connection must have negotiated a MaxRecvDataSegmentLength above 8192 - this is the default (262144) in open-iscsi, so default configurations are vulnerable - and the attacker must return an ISCSI_OP_SCSI_CMD_RSP PDU with a DataSegmentLength between 8193 and that negotiated maximum. Limiting factors that reduce real-world risk: the malicious data comes from the storage target, so an attacker must own or impersonate a target the host already connects to (not any arbitrary internet host); deployments that use CHAP mutual authentication, IPsec, or isolated storage networks make interposition hard; and hosts that do not use software iSCSI are not exposed at all.

The signals conflict and should be read together rather than trusting the 9.8 alone. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as trivial remote unauthenticated RCE, but the description makes clear the overflow is delivered by the iSCSI TARGET to a connecting initiator - i.e. a malicious or compromised storage target, or an attacker able to interpose as one, not an arbitrary remote host. That trust/positioning requirement realistically raises attack complexity and narrows exposure well below what a 9.8 implies, so I assess it closer to High (see assessed vectors). Supporting a lower real-world priority: EPSS is 0.16% (5th percentile), there is no KEV listing, and no public PoC is identified. Countering that: it is a kernel-context heap overflow with potential for code execution or at least denial of service, and the default open-iscsi MaxRecvDataSegmentLength (262144) means vulnerable initiators are exploitable in default configuration once pointed at a hostile target. Net: patch promptly on hosts that mount iSCSI LUNs from networks or targets that are not fully trusted (data centers, cloud block storage, SAN environments), where even a mid-sized operator should treat a compromised or rogue target as a credible path to kernel compromise; deprioritize on hosts that use no iSCSI or only tightly controlled internal targets.

An attacker who controls an iSCSI target - a rogue appliance on the storage network, a compromised SAN, or a man-in-the-middle on an unauthenticated iSCSI session - waits for a Linux initiator that has negotiated a large MaxRecvDataSegmentLength (the open-iscsi default of 262144) to issue a SCSI command. The target replies with a SCSI Command Response carrying a DataSegmentLength between 8193 and the negotiated maximum, overflowing the 8192-byte conn->data buffer in kernel memory and enabling denial of service or potential kernel code execution. No public PoC is currently known, and the attacker must be positioned as the target the initiator connects to.