Linux kernel libiscsi: Out-of-bounds read via negative task index
Summary
A flaw in the Linux kernel iSCSI initiator library (libiscsi) lets a negative task index from a transport driver be used, causing an out-of-bounds memory read. The bug is reachable through the be2iscsi driver when a crafted unsolicited NOP-In PDU is received from an iSCSI target or an on-path attacker. Exposure is limited to hosts with be2iscsi hardware and active iSCSI sessions. The CVSS 9.8 score supplied with the request could not be verified, as no NVD score was available in the sources.
Affected
- Linux kernel, commits from bfead3b2cb4607c71831423c3ee97d22cd0c9dcb up to the fix commits
- Per CNA data: affected from 2.6.33; stable branches 5.10, 5.15, 6.1, 6.6, 6.12 and 6.18 are affected before their fixed point releases
- Exact affected point releases per stable branch: Unknown.
Fixed in
- Upstream stable commits: 0eb06ebb, 24bd9ba4, 35b60549, 6200fb2d, 6cadfa6f, 8ee2a09a, e896a97f, f8fabe1f
- Fixed point releases per branch (per OSV): 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13
- Mainline 7.3 is listed as unaffected by the CNA data.
Workaround
- No vendor workaround documented.
- If no be2iscsi hardware is in use, blacklist the be2iscsi kernel module.
- Keep iSCSI traffic on an isolated storage network and enable CHAP where supported.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV; no public exploit code known.
- Upstream analysis was done from source code, as the patch author had no be2iscsi hardware.
Our recommendation
- Inventory hosts for be2iscsi adapters and active iSCSI sessions.
- Where present, apply the distribution kernel update through the normal patch cycle.
- Prioritise as medium to low unless the storage network is shared with untrusted segments.
- Re-check the NVD score once NVD publishes its analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 0eb06ebb git.kernel.org
- Linux stable commit 24bd9ba4 git.kernel.org
- Linux stable commit 35b60549 git.kernel.org
- Linux stable commit 6200fb2d git.kernel.org
- Linux stable commit 6cadfa6f git.kernel.org
- Linux stable commit 8ee2a09a git.kernel.org
- Linux stable commit e896a97f git.kernel.org
- Linux stable commit f8fabe1f git.kernel.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:21.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups.
NVD references (8)
- https://git.kernel.org/stable/c/0eb06ebbbecb122f0df9a1f7f623f5255be741ed
- https://git.kernel.org/stable/c/24bd9ba431b2daa263f3551bc2f09f6b4487f5ae
- https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7
- https://git.kernel.org/stable/c/6200fb2de579f268742a77b0f3d823cb0a8b1947
- https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e
- https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142
- https://git.kernel.org/stable/c/e896a97f336c5edfc13066b57ed431cb3f64e68c
- https://git.kernel.org/stable/c/f8fabe1fe044f86abc42194b8f86dfd70212115f
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.