Cloudanix VulnDB

CVE-2026-99153

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's iSCSI code can let a storage server send a bad message that crashes the computer or makes it think a data read succeeded when nothing was actually received.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of the Initiator Task Tag (ITT) reflected in an iSCSI Reject PDU allows an untrusted target to supply an arbitrary index; iscsi_itt_to_task() returns any task from the pool, enabling iscsi_nop_out_rsp() to complete an in-flight SCSI command as successful with no data transferred or to trigger a NULL dereference and refcount underflow on a freed task.

Why it matters to the business

Systems using the Linux iSCSI initiator can experience kernel crashes, unexpected reboots, or silent corruption of read data returned from storage targets, leading to loss of availability for iSCSI-backed volumes and potential data-integrity failures in virtual machines or containers relying on remote block storage.

How an attack unfolds

An attacker who controls or can influence an iSCSI target sends a Reject PDU whose copied header contains a chosen ITT value; the initiator's iscsi_handle_reject path copies the header, looks up the task without verifying it is a valid in-flight non-SCSI task, and either completes the wrong command or dereferences a freed structure, producing the observed GPF.

How to fix it

Apply the upstream fix that adds the same ITT validation performed by iscsi_itt_to_ctask() and rejects non-in-flight or SCSI-command tasks; update to a kernel containing the commit that resolves the issue in libiscsi.

How to confirm the fix worked

Confirm the presence of the validation logic in iscsi_handle_reject() that calls iscsi_itt_to_ctask-style checks and requires the task to be in-flight and not a SCSI command; verify the patched kernel no longer accepts arbitrary ITT values from Reject PDUs.

Typical attack path

  1. Establish an iSCSI session with a malicious or compromised target
  2. Trigger the target to emit a Reject PDU containing an attacker-chosen ITT value
  3. Initiator copies the reflected header and calls iscsi_itt_to_task without further checks
  4. iscsi_nop_out_rsp completes an arbitrary or freed task, causing crash or silent SCSI command success
  5. Attacker observes kernel oops or continues to abuse the session for further anomalies

How to detect it

Search kernel logs and dmesg for strings referencing iscsi_nop_out_rsp, iscsi_handle_reject, general protection fault, KASAN null-ptr-deref, and the specific RIP offset shown in the oops; inspect iSCSI session teardown events that coincide with unexpected task completions.

  • iscsi_nop_out_rsp.constprop
  • iscsi_handle_reject
  • KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
  • Oops: general protection fault, probably for non-canonical address
  • WARNING: at drivers/scsi/libiscsi.c iscsi_complete_task

What your security team should do

  • Prioritize kernel updates for all systems exposing the iSCSI initiator to untrusted targets
  • Monitor for kernel oops containing iscsi_nop_out_rsp and KASAN null-ptr-deref reports
  • Restrict iSCSI targets to trusted endpoints until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0

Affected packages

Ecosystem Package Introduced Fixed