GHSA-X575-Q9WV-7P43

Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-17 06:33
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen:

senselen = get_unaligned_be16(data);
if (datalen < senselen)
    goto invalid_datalen;
memcpy(sc->sense_buffer, data + 2,
       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));

A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace.

Account for the 2-byte sense length prefix in the check.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-74557"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T13:18:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment.  The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data.  Those bytes are stale\nconn-\u003edata contents and end up in the command\u0027s sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check.",
  "id": "GHSA-x575-q9wv-7p43",
  "modified": "2026-08-17T06:33:53Z",
  "published": "2026-08-15T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74557"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.