CVE-2026-99153 (GCVE-0-2026-99153)

Vulnerability from cvelistv5 – Published: 2026-10-28 10:35 – Updated: 2026-10-31 12:44
VLAI
Title
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6846 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < 3637a4ad1d07477f1c60609876da6b60154d224b (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < 21ef746340ce246344f34278e205b8960c1d8874 (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < d20583a9dbe0d32a9af8384c857c95c0fc115103 (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < ebb8c5ef2aabf66895253600e8390e8fc7094807 (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < 576125e7382a7826bd6c3c1ca4d9c582ed5be21d (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < 7215a69b6456fda79c0935c2959045dff3fcaac8 (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a (git)
Affected: 8afa1439fcff58da8f28c1d083046f229f6ab3de , < c5958c770b2a0ee492414e26b07da9164a0d1f5d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.32
Unaffected: 0 , < 2.6.32 (semver)
Unaffected: 5.10.273 , ≤ 5.10.* (semver)
Unaffected: 5.15.224 , ≤ 5.15.* (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.161 , ≤ 6.6.* (semver)
Unaffected: 6.12.115 , ≤ 6.12.* (semver)
Unaffected: 6.18.59 , ≤ 6.18.* (semver)
Unaffected: 7.2.13 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3637a4ad1d07477f1c60609876da6b60154d224b",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "21ef746340ce246344f34278e205b8960c1d8874",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "d20583a9dbe0d32a9af8384c857c95c0fc115103",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "ebb8c5ef2aabf66895253600e8390e8fc7094807",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "576125e7382a7826bd6c3c1ca4d9c582ed5be21d",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "7215a69b6456fda79c0935c2959045dff3fcaac8",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "c5958c770b2a0ee492414e26b07da9164a0d1f5d",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.161",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[    6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[    6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[    6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[    6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[    6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[    6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[    6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[    6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[    6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[    6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[    6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[    6.254549] FS:  0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[    6.254887] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[    6.255439] PKRU: 55555554\n[    6.255564] Call Trace:\n[    6.255674]  \u003cIRQ\u003e\n[    6.255768]  __iscsi_complete_pdu+0x18bf/0x22a0\n[    6.256733]  iscsi_complete_pdu+0x54/0xa0\n[    6.256905]  iscsi_tcp_data_recv_done+0xf4/0x250\n[    6.257103]  iscsi_tcp_recv_skb+0x31e/0xec0\n[    6.257680]  iscsi_sw_tcp_recv+0x12f/0x390\n[    6.258061]  __tcp_read_sock+0x1ab/0x810\n[    6.258853]  iscsi_sw_tcp_data_ready+0x18b/0x510\n[    6.259808]  tcp_data_queue+0x1f13/0x4cd0\n[    6.260567]  tcp_rcv_established+0x8a5/0x3a00\n[    6.261931]  tcp_v4_do_rcv+0x449/0x960\n[    6.262269]  tcp_v4_rcv+0x2245/0x3bc0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A target-supplied ISCSI_OP_REJECT traverses iscsi_sw_tcp_data_ready(), iscsi_tcp_recv_skb(), iscsi_tcp_data_recv_done(), iscsi_complete_pdu(), and __iscsi_complete_pdu() to the patched iscsi_handle_reject(); the forged NOOP_OUT ITT is carried in the Reject PDU data over routable TCP.\nAC:L - The target sees live SCSI ITTs in initiator commands and can withhold their responses before naming one in a forged Reject; alternatively, index 1 in a freshly bound kzalloc\u0027ed pool deterministically has task-\u003econn == NULL. No race or uncontrolled condition is required.\nPR:N - iscsi_sw_tcp_conn_bind() installs receive callbacks before iscsi_conn_start() marks the session logged in, while __iscsi_complete_pdu() and iscsi_handle_reject() impose no login-state or authentication check on Reject PDUs. A target can therefore trigger the crash during login without credentials.\nUI:N - Once a configured initiator binds or automatically reconnects its iSCSI socket, the target\u0027s Reject is processed directly by iscsi_sw_tcp_data_ready(); selecting an unused task slot requires no victim read, mount, or other action.\nS:U - iscsi_handle_reject() corrupts task completion state or faults within the initiator host kernel; it does not cross a VM, IOMMU, or separate security-authority boundary.\nC:H - For a READ ITT, iscsi_nop_out_rsp() reaches iscsi_complete_task() and scsi_done() with sc-\u003eresult still zero despite no Data-In; non-zeroed page-cache folios can consequently be marked uptodate and exposed as valid data, with the commit demonstrating a 1 MiB untouched read.\nI:H - The unchecked ITT lets iscsi_nop_out_rsp() falsely complete any observed in-flight SCSI task successfully; untouched READ buffers become valid filesystem data and WRITE commands can be acknowledged without commitment, permitting silent persistent storage or filesystem corruption.\nA:H - Selecting a never-used pool slot returns a task whose kzalloc\u0027ed task-\u003econn is NULL, which iscsi_nop_out_rsp() dereferences; the commit records the resulting general-protection fault, so one crafted Reject can oops or panic the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T12:44:04.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874"
        },
        {
          "url": "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807"
        },
        {
          "url": "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"
        }
      ],
      "title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99153",
    "datePublished": "2026-10-28T10:35:08.287Z",
    "dateReserved": "2026-09-25T10:25:14.396Z",
    "dateUpdated": "2026-10-31T12:44:04.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99153",
      "date": "2026-11-03",
      "epss": "0.00552",
      "percentile": "0.46162"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-01T14:50:43.000Z",
      "cve": "CVE-2026-99153",
      "id": "msrc_CVE-2026-99153",
      "initial_release_date": "2026-10-29T01:06:08.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-99153.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/libiscsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3637a4ad1d07477f1c60609876da6b60154d224b",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "21ef746340ce246344f34278e205b8960c1d8874",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d20583a9dbe0d32a9af8384c857c95c0fc115103",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ebb8c5ef2aabf66895253600e8390e8fc7094807",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "576125e7382a7826bd6c3c1ca4d9c582ed5be21d",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7215a69b6456fda79c0935c2959045dff3fcaac8",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c5958c770b2a0ee492414e26b07da9164a0d1f5d",
                    "status": "affected",
                    "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/libiscsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.32"
                  },
                  {
                    "lessThan": "2.6.32",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.273",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.224",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.161",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.115",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[    6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[    6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[    6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[    6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[    6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[    6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[    6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[    6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[    6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[    6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[    6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[    6.254549] FS:  0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[    6.254887] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[    6.255439] PKRU: 55555554\n[    6.255564] Call Trace:\n[    6.255674]  \u003cIRQ\u003e\n[    6.255768]  __iscsi_complete_pdu+0x18bf/0x22a0\n[    6.256733]  iscsi_complete_pdu+0x54/0xa0\n[    6.256905]  iscsi_tcp_data_recv_done+0xf4/0x250\n[    6.257103]  iscsi_tcp_recv_skb+0x31e/0xec0\n[    6.257680]  iscsi_sw_tcp_recv+0x12f/0x390\n[    6.258061]  __tcp_read_sock+0x1ab/0x810\n[    6.258853]  iscsi_sw_tcp_data_ready+0x18b/0x510\n[    6.259808]  tcp_data_queue+0x1f13/0x4cd0\n[    6.260567]  tcp_rcv_established+0x8a5/0x3a00\n[    6.261931]  tcp_v4_do_rcv+0x449/0x960\n[    6.262269]  tcp_v4_rcv+0x2245/0x3bc0"
          }
        ],
        "id": "CVE-2026-99153",
        "lastModified": "2026-10-31T13:17:57.617",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-28T11:17:35.443",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-02T03:24:53+00:00",
      "cve": "CVE-2026-99153",
      "id": "CVE-2026-99153",
      "initial_release_date": "2026-10-28T10:35:08.287000+00:00",
      "product_status:known_affected": "279",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-99153.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.