CVE-2026-43055: scsi: target: file: Use kzalloc_flex for aio_cmd
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: file: Use kzallocflex for aiocmd
The targetcorefile doesn't initialize the aiocmd->iocb for the kiwritestream. When a write command fdexecuterwaio() is executed, we may get a bogus kiwritestream value, causing unintended write failure status when checking iocb->kiwritestream > maxwritestreams in the block device.
Let's just use kzallocflex when allocating the aiocmd and let kiwritestream=0 to fix this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43055?
The severity of CVE-2026-43055 is classified as Medium.
How do I fix CVE-2026-43055?
To fix CVE-2026-43055, update to the latest patched version of the Linux kernel.
What are the potential impacts of CVE-2026-43055?
The potential impacts of CVE-2026-43055 include undefined behavior and data corruption in some SCSI commands.
Which versions of the Linux kernel are affected by CVE-2026-43055?
CVE-2026-43055 affects specific versions of the Linux kernel prior to the fix being applied.
Is CVE-2026-43055 a remote code execution vulnerability?
CVE-2026-43055 is not categorized as a remote code execution vulnerability.