CVE-2026-74556

Received Received - Intake

Buffer Overflow in Linux Kernel iSCSI TCP Implementation

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74556

EUVD

EUVD-2026-59621

Affected Vendors & Products

Vendor	Product	Version / Range
iscsi	libiscsi_tcp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the iSCSI TCP implementation. The issue occurs when handling SCSI Command Response PDUs, where the data segment length is not properly bounded to the connection buffer size (8192 bytes). Attackers could exploit this to overflow the buffer by sending responses with data lengths between 8193 and the negotiated maximum (often much larger).

Detection Guidance

This vulnerability involves a buffer overflow in the Linux kernel's iSCSI TCP implementation. Detection requires checking for vulnerable kernel versions and monitoring for unusual iSCSI traffic patterns. Examine kernel logs for iSCSI-related errors or crashes, and verify if your system uses a vulnerable iSCSI configuration. Use commands like 'uname -a' to check kernel version and 'dmesg | grep iscsi' to inspect iSCSI-related messages.

Impact Analysis

If exploited, this vulnerability could lead to memory corruption, crashes, or potential arbitrary code execution on systems using the affected iSCSI TCP functionality. Systems acting as iSCSI initiators or targets may be vulnerable if they use vulnerable kernel versions.

Compliance Impact

This vulnerability involves a buffer overflow in the Linux kernel's iSCSI TCP implementation, allowing a target to send oversized SCSI Response data segments that exceed the allocated buffer size. While the impact on compliance standards like GDPR or HIPAA is not explicitly detailed in the provided context, such vulnerabilities could potentially lead to data integrity issues or unauthorized access if exploited, which may violate data protection requirements under these regulations.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for this vulnerability. If updating is not immediately possible, disable the iSCSI TCP module by running 'modprobe -r iscsi_tcp' and prevent it from loading at boot with 'echo 'blacklist iscsi_tcp' >> /etc/modprobe.d/blacklist.conf'. Monitor vendor advisories for kernel updates and apply them as soon as available.

Hi! I’m here to help you understand CVE-2026-74556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70