Linux kernel libiscsi: Missing validation of Reject PDU task tag
Summary
The iSCSI initiator library (libiscsi) in the Linux kernel trusts the initiator task tag (ITT) echoed in a Reject PDU sent by an iSCSI target without validating it. A malicious or compromised target can name any task in the pool, which can crash the kernel (denial of service) or complete an in-flight SCSI read as successful without its data being written, causing silent data corruption. Exploitation requires an established iSCSI session, so the realistic threat is a compromised storage target or an attacker who can intercept iSCSI traffic on the storage network.
Affected
- Linux kernel versions with commit 8afa1439fcff58da8f28c1d083046f229f6ab3de and later, before the fixes listed in the stable branches.
- Per the CNA record, the stable branches 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13 are unaffected.
- Exact affected version ranges are not fully confirmed by the vendor-independent sources; verify against the kernel commits.
- Only Linux systems acting as iSCSI initiators are relevant. Windows and VMware ESXi are not affected.
Fixed in
- Fixed in the stable kernel releases 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13 (per the CNA record and OSV).
- Upstream fix commits: 21ef746340ce246344f34278e205b8960c1d8874, 3637a4ad1d07477f1c60609876da6b60154d224b, 576125e7382a7826bd6c3c1ca4d9c582ed5be21d, 7215a69b6456fda79c0935c2959045dff3fcaac8, c5958c770b2a0ee492414e26b07da9164a0d1f5d, d20583a9dbe0d32a9af8384c857c95c0fc115103, d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a, ebb8c5ef2aabf66895253600e8390e8fc7094807.
- Ubuntu: no fixed kernel published yet (status Needs evaluation).
Workaround
- No vendor-published workaround found.
- Connect Linux initiators only to trusted iSCSI targets.
- Keep iSCSI traffic on a dedicated storage VLAN without internet route.
- Enable CHAP or IPsec where the storage platform supports it.
These measures reduce exposure but are not a complete fix.
Exploitation
- Exploited in the wild: no evidence found; not known to be exploited (OffSeq).
- Public proof of concept: none found in the checked indexes.
- The patch author reproduced the crash with a kernel test harness using a proxy that injected one Reject PDU; this is not a public exploit.
- Severity ratings differ: CVSS 9.8 as supplied, OffSeq High, Ubuntu Medium.
- EPSS: 0.18 % (percentile 8).
Our recommendation
- Inventory Linux hosts that use iSCSI sessions (for example with iscsiadm).
- Install the vendor kernel update as soon as your distribution publishes a fixed kernel; check it against the listed fix commits.
- Isolate iSCSI traffic on a dedicated storage network and confirm that only trusted targets are configured.
- Monitor kernel logs for iSCSI errors, crashes or warnings (for example WARN_ON in libiscsi).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 21ef746340ce246344f34278e205b8960c1d8874 git.kernel.org
- Linux stable commit 3637a4ad1d07477f1c60609876da6b60154d224b git.kernel.org
- Linux stable commit 576125e7382a7826bd6c3c1ca4d9c582ed5be21d git.kernel.org
- Linux stable commit 7215a69b6456fda79c0935c2959045dff3fcaac8 git.kernel.org
- Linux stable commit c5958c770b2a0ee492414e26b07da9164a0d1f5d git.kernel.org
- Linux stable commit d20583a9dbe0d32a9af8384c857c95c0fc115103 git.kernel.org
- Linux stable commit d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a git.kernel.org
- Linux stable commit ebb8c5ef2aabf66895253600e8390e8fc7094807 git.kernel.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:21.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0
NVD references (8)
- https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874
- https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b
- https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d
- https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8
- https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d
- https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103
- https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a
- https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.