CVE-2026-80691

CVE-2026-80691 is a NULL function-pointer dereference in the Linux kernel's SCSI target iblock backend: in iblock_execute_pr_out(), the PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE persistent-reservation operations are gated by a capability check on ops->pr_clear rather than on the hooks actually invoked, so targets lacking the needed hooks pass the check and the kernel calls a NULL pointer. An attacker with network access to the SCSI target (e.g., an iSCSI initiator session) can trigger the crash by sending a PREEMPT, PREEMPT AND ABORT, or RELEASE persistent-reservation command. The result is a kernel oops/panic and denial of service on the target host, with no confidentiality or integrity impact. Systems are affected only when they run the in-kernel LIO SCSI target with the iblock backend and expose persistent-reservation operations to initiators, which is typical of Linux-based SAN/iSCSI and shared-storage deployments. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Track your distribution's kernel updates and apply the upstream fix ('scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE') as soon as it is incorporated into a stable or vendor kernel; no specific fixed version number is available in the source data. In the interim, restrict which initiators can reach LIO/iblock-backed targets (iSCSI ACLs, initiator allowlists, network segmentation) and monitor for kernel oops/panics in target logs; administrators should check whether hosts run targetcli/LIO with iblock backends and expose PR PREEMPT/RELEASE operations to remote initiators.