Cloudanix VulnDB

CVE-2026-99154

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's iSCSI code could let a storage device send a bad number that makes the system read memory it shouldn't, potentially causing crashes or leaks.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

A negative task index supplied by a transport's parse_pdu_itt implementation bypasses the upper-bound check on session->cmds[], resulting in an out-of-bounds read before the start of the array.

Why it matters to the business

Systems using iSCSI with affected hardware may experience kernel instability, memory disclosure, or local privilege escalation, increasing risk of downtime or compromise on storage-connected servers.

How an attack unfolds

An attacker controlling an iSCSI target or the hardware ring sends an unsolicited NOP-In PDU whose ITT field contains a negative value; the be2iscsi driver forwards this raw value without sanitization, causing libiscsi to index the cmds array with a negative offset and read attacker-controlled or adjacent kernel memory.

How to fix it

Apply the upstream kernel commit that adds a lower-bound check on the task index in both parse_pdu_itt lookup sites; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the libiscsi source for the added (i < 0) test before the cmds_max comparison, then verify the running kernel version contains the fix and test iSCSI sessions with be2iscsi hardware.

Typical attack path

  1. Attacker supplies crafted ITT via hardware async ring or malicious target
  2. beiscsi_parse_pdu converts ITT directly to signed int without lower-bound validation
  3. libiscsi performs only upper-bound check allowing negative index
  4. session->cmds[negative] is dereferenced, reading memory before the array
  5. Resulting invalid data may crash the kernel or leak sensitive contents

How to detect it

Review kernel logs for oops or panic messages referencing iscsi_verify_itt or libiscsi array access; inspect be2iscsi driver logs for unsolicited NOP-In PDUs with unexpected ITT values.

What your security team should do

  • Prioritize patching kernel packages on all hosts that use iSCSI storage with be2iscsi or similar drivers
  • Monitor vendor advisories for distribution backports of the negative-index fix
  • Restrict iSCSI exposure to trusted networks until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups.

Affected packages

Ecosystem Package Introduced Fixed