Cloudanix VulnDB

CVE-2026-80691

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's handling of certain storage reservation commands can let an attacker crash affected systems over the network.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in iblock_execute_pr_out when PRO_PREEMPT, PRO_PREEMPT_AND_ABORT or PRO_RELEASE paths invoke an unimplemented ops->pr_clear hook without prior capability validation.

Why it matters to the business

Remote attackers can trigger kernel crashes on systems exposing iSCSI or other SCSI target interfaces, causing denial of service for storage workloads and potential data unavailability.

How an attack unfolds

An attacker with network access to a SCSI target sends a PERSISTENT RESERVE OUT command using PRO_PREEMPT, PRO_PREEMPT_AND_ABORT or PRO_RELEASE; the flawed NULL check allows the kernel to dereference a NULL function pointer and panic.

How to fix it

Update to a Linux kernel containing the fix for the iblock PR ops NULL check; apply the upstream patch that adds explicit hook support validation before calling pr_clear and related callbacks.

How to confirm the fix worked

Inspect iblock.c for the corrected capability check preceding the pr_clear invocation; confirm the vulnerable three-line NULL check pattern is no longer present and test with crafted PR commands that previously triggered the bug.

Typical attack path

  1. Identify Linux host running vulnerable kernel exposing SCSI target via iSCSI or similar
  2. Craft and send PERSISTENT RESERVE OUT command with PRO_PREEMPT, PRO_PREEMPT_AND_ABORT or PRO_RELEASE
  3. Trigger iblock_execute_pr_out path that skips capability check
  4. Kernel dereferences NULL pr_clear hook and crashes

How to detect it

Search kernel logs for oops or panic messages containing iblock_execute_pr_out or references to NULL function pointer dereference during PERSISTENT RESERVE OUT handling; correlate with unexpected SCSI target resets.

  • iblock_execute_pr_out
  • PRO_PREEMPT
  • PRO_PREEMPT_AND_ABORT
  • PRO_RELEASE
  • ops->pr_clear

What your security team should do

  • Prioritize kernel updates on all systems exposing SCSI targets
  • Restrict network exposure of iSCSI and other target interfaces to trusted initiators only
  • Monitor for kernel oops/panics referencing iblock_execute_pr_out
  • Review downstream distributions for backported fixes once available

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer. Check whether the hooks that need to be called are supported.

Affected packages

Ecosystem Package Introduced Fixed