CVE-2026-90011
moderateMissing NUL terminator in Linux kernel iSCSI target (LIO) login enables slab OOB read
The Linux kernel's iSCSI target implementation (LIO, drivers/target/iscsi) allocates the login request buffer at exactly MAX_KEY_VALUE_PAIRS (8192) bytes, and its length check uses '>' instead of '>=', so a login PDU payload of 8189-8192 bytes (plus padding) fills the entire buffer with no byte left for a NUL terminator. The buffer is subsequently parsed as a C string by functions such as strstr(), kstrdup() and strlen_semi() in the CHAP authentication path, and convert_null_to_semi() rewrites embedded NULs to semicolons, so parsing walks past the end of the object into adjacent slab memory (out-of-bounds read). An unauthenticated initiator can trigger it by sending a crafted login request to a portal configured for CHAP authentication; portals that do not require authentication rewrite AuthMethod to None and never enter the CHAP path. Per the CVSS score of 9.1, an attacker gains information disclosure (C:H) and denial of service (A:H), with no integrity impact. No public proof-of-concept or in-the-wild exploitation is known; the fix allocates one extra zeroed byte so the buffer is always terminated.
What to do: Apply a kernel update containing this SCSI target (iscsi_target) fix as soon as it reaches your vendor/distro kernel; no fixed version number is given in the source data, so check your vendor's advisory for the backport. Until patched, restrict TCP port 3260 on iSCSI portals to trusted initiator networks with firewall/ACL rules, and note that portals without mandatory CHAP (AuthMethod None) are not reachable through the vulnerable code path. Check whether any Linux hosts run targetcli/LIO with CHAP configured and whether those portals are exposed beyond the storage network.
| Linux kernel, SCSI target subsystem - iSCSI target (LIO, drivers/target/iscsi) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.