EUVD-2026-103719
GHSA-m9q9-jv5w-f7p7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInitiator connects to malicious iSCSI target
-
DeliveryHost issues WRITE, target sends R2T then Data-In
-
ExploitDirection unchecked in iscsi_tcp_hdr_dissect()
-
ExecutionTarget bytes copied into write scatterlist
-
ImpactCorrupt O_DIRECT buffer or page-cache data
Vulnerability Assessment
| Exploitation Conditions | The Linux host must act as an iSCSI initiator using the software iSCSI/TCP transport (libiscsi_tcp) and be connected to a malicious or compromised iSCSI target; the target must answer an in-flight WRITE command's ITT with a Data-In PDU (demonstrated with a 512-byte Data-In sent after the WRITE's R2T). The decisive limiting factor is the trust boundary: iSCSI targets are normally trusted storage, so a benign target never triggers this - exploitation requires a hostile or attacker-controlled target. No special initiator configuration beyond using software iSCSI with active WRITE traffic is needed; O_DIRECT writes expose the corruption via mismatched pwrite() return values, while buffered writes corrupt page-cache pages silently. |
| Impact | The CVSS 3.1 base score of 7.5 (HIGH) with AV:N/AC:L/PR:N/UI:N reads as a remote, unauthenticated, low-complexity flaw, but that framing is misleading: the 'attacker' here is the iSCSI target the initiator has connected to. Exploitation requires the Linux host to be talking to a malicious or compromised iSCSI target, which inverts the normal trust model where targets are trusted storage backends - so this is not an arbitrary-remote-attacker issue despite the network vector. The supporting signals all point to low real-world urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit is identified (the references are kernel.org stable patch commits, not PoC code). The vuln.today decision label is 'this_week,' consistent with a patch-promptly-but-not-emergency posture. Impact is integrity-only (C:N/I:H/A:N): silent corruption of data a WRITE was about to send, which is serious for data-integrity-sensitive workloads but does not grant the attacker code execution, availability loss, or confidentiality breach of the victim's data. Net: a legitimately HIGH-integrity-impact bug, but a comparatively low-priority one in practice because the required precondition (connecting to a hostile iSCSI target) is uncommon in trusted-SAN deployments. |
| Exploit ScenarioDerived | A Linux host using the software iSCSI (libiscsi_tcp) initiator connects to a malicious or compromised iSCSI target. When the host issues a WRITE, the target answers that command's ITT with a Data-In PDU (observed with a single 512-byte Data-In after the R2T); because the Data-In path never checks the command's data direction, the initiator copies target-supplied bytes into the write's own scatterlist, silently corrupting the O_DIRECT caller buffer or page-cache pages. No public exploit is available, though the reporter demonstrated the behavior against a test target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
The software iSCSI initiator (libiscsi_tcp) in the Linux kernel can be induced by a hostile or compromised iSCSI target to write target-supplied bytes into memory that belongs to an in-flight WRITE command, corrupting either the caller's pinned user buffer (O_DIRECT) or page-cache pages (buffered I/O). The flaw is that iscsi_tcp_hdr_dissect() resolves a Data-In PDU's ITT to a task and copies the data segment into that command's scatterlist without verifying the command was a read, unlike iscsi_tcp_r2t_rsp() which rejects R2T PDUs for non-DMA_TO_DEVICE commands; a 512-byte Data-In naming a 128 KB write's ITT leaves the buffer holding target data while pwrite() still returns 131072, and the buffered path logs nothing while reads from those blocks return the target's bytes from page cache. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects remote, low-complexity reachability, but exploitation is bounded by the trust boundary: the initiator must be connected to a malicious or attacker-controlled iSCSI target, which is not the normal deployment model for iSCSI storage. No public exploit code or active exploitation was identified at time of analysis (EPSS 0.18%, 7th percentile), and vendor patches are available across all supported branches.
RemediationAI
Vendor-released patches are available: update to Linux 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 or 7.3-rc5, or apply the corresponding stable commit (for example https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b) on branches where a distribution kernel has not yet picked up the fix, and consult the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-98479 for the authoritative mapping of commits to versions. Because the flaw is only reachable from the target side, the decisive compensating control until patching is to keep the initiator's iSCSI trust boundary intact - connect only to iSCSI targets and portals that are under your own administrative control and are not reachable or configurable by untrusted parties, since a benign target never emits a Data-In for a WRITE's ITT and this control fully removes the trigger. Where a target cannot be fully trusted, avoid issuing writes to it from a libiscsi_tcp initiator; note that the trade-off is loss of that storage path, and that no logging or error indication accompanies the buffered-write corruption, so detection after the fact is unreliable - integrity verification of written data (for example comparing readback for O_DIRECT workloads where pwrite() length mismatches would otherwise be the only signal) is a detection aid, not a fix. No other workaround is documented in the supplied sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iSCSI carries SCSI commands over TCP, and the Linux kernel's software initiator implements it in drivers/scsi/libiscsi_tcp.c, where received PDUs are parsed by iscsi_tcp_hdr_dissect(). Each iSCSI PDU carries an Initiator Task Tag (ITT) that the initiator uses to map the PDU back to the outstanding SCSI command structure. In the Data-In branch of that dissector, the code resolved the ITT to a task and copied the PDU's data segment directly into the command's scatterlist without checking whether the command was a read - the sibling R2T handler, iscsi_tcp_r2t_rsp(), already performs exactly this check and rejects an R2T for a command that is not DMA_TO_DEVICE. Because a WRITE command's scatterlist references the initiator's own outgoing data pages - the caller's pinned pages for O_DIRECT, page-cache pages for buffered writes - a target that replies to a WRITE's ITT with a Data-In PDU overwrites the very memory that write was about to transmit. The upstream fix adds the missing direction check before the scatterlist is used, mirroring the R2T path. No CWE identifier was assigned in the supplied data, and the trigger details above derive from the commit message's description of the Data-In path; nothing in the sources indicates a separate memory-safety class such as a heap overflow or use-after-free. The affected component has existed since the libiscsi_tcp code was introduced, with EUVD listing the lower bound of the vulnerable range as Linux 2.6.29.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The hostile iSCSI target reaches the initiator over the network (AV:N) and controls the malicious Data-In PDU (AC:L, PR:N, UI:N); impact is integrity-only corruption of write data (I:H, C:N, A:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.
A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one.
Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire.
Check the direction before using the scatterlist, the way the R2T path already does.
Executive ViewAI
A high-severity flaw in the Linux kernel's iSCSI initiator allows a compromised or malicious iSCSI storage target to silently corrupt data written by applications, affecting both direct and page-cache I/O. Organizations relying on iSCSI for storage-especially in cloud, virtualized, or shared-storage environments-face integrity risks to critical data, though exploitation requires control of the storage target. Leadership should prioritize patching to prevent potential data corruption and maintain trust in storage infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB