CVE-2026-74557

Received Received - Intake

Heap Buffer Overflow in Linux Kernel SCSI iSCSI Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74557

EUVD

EUVD-2026-59622

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the iSCSI subsystem where a buffer overflow can occur. When processing SCSI responses, the system copies sense data from a target-supplied segment but fails to properly account for a 2-byte sense length prefix. This can lead to reading up to two extra bytes of stale data, which then gets included in the command's sense buffer and exposed to userspace.

Detection Guidance

This vulnerability is related to the Linux kernel's iSCSI subsystem and involves a bounds check issue in the iscsi_scsi_cmd_rsp() function. Detection requires checking for vulnerable kernel versions and inspecting iSCSI target responses for malformed sense data. No direct commands are provided in the context to detect this issue on a live system.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory contents from the kernel, potentially exposing confidential data. It may also lead to system instability or crashes if the stale data corrupts critical operations. Systems using iSCSI for storage are primarily affected.

Compliance Impact

This vulnerability involves a stale-data leak into the SCSI sense buffer, which could expose sensitive information from kernel memory to userspace. While not directly tied to GDPR or HIPAA, such data exposure risks violating confidentiality requirements under these regulations if sensitive data is involved.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the stale-data leak in the SCSI sense buffer. Monitor vendor advisories for kernel updates addressing CVE-2026-74557.

Hi! I’m here to help you understand CVE-2026-74557. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70