CVE-2026-43055: scsi: target: file: Use kzalloc_flex for aio_cmd
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: file: Use kzallocflex for aiocmd
The targetcorefile doesn't initialize the aiocmd->iocb for the kiwritestream. When a write command fdexecuterwaio() is executed, we may get a bogus kiwritestream value, causing unintended write failure status when checking iocb->kiwritestream > maxwritestreams in the block device.
Let's just use kzallocflex when allocating the aiocmd and let kiwritestream=0 to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
Allocate aio_cmd with kzalloc_flex so that ki_write_stream is zero-initialized.
Linux kernel target_core_file aio_cmd ki_write_stream = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43055?
The severity of CVE-2026-43055 is classified as Medium.
How do I fix CVE-2026-43055?
To fix CVE-2026-43055, update to the latest patched version of the Linux kernel.
What are the potential impacts of CVE-2026-43055?
The potential impacts of CVE-2026-43055 include undefined behavior and data corruption in some SCSI commands.
Which versions of the Linux kernel are affected by CVE-2026-43055?
CVE-2026-43055 affects specific versions of the Linux kernel prior to the fix being applied.
Is CVE-2026-43055 a remote code execution vulnerability?
CVE-2026-43055 is not categorized as a remote code execution vulnerability.