CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: configfs: Bound snprintf() return in tgptgpmembersshow()
targettgptgpmembersshow() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() curlen bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIGFORTIFYSOURCE is enabled, fortifypanic() will be triggered.
Commit 27e06650a5ea ("scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow") added the same bound to the targetlugpmembersshow() but the tgptgp variant was missed so resolve that here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who can trigger this issue?
The CVSS vector indicates local access with low privileges is required. The vulnerable path is reached when a sysfs reader accesses the affected target configuration output.
What condition is needed to expose memory beyond the stack buffer?
The formatted LUN path must exceed the 256-byte stack buffer. The description specifically notes that a long fabric WWN can cause this, because iSCSI IQN names may be up to 223 bytes.
What is the likely impact on systems built with CONFIG_FORTIFY_SOURCE?
When CONFIG_FORTIFY_SOURCE is enabled, the out-of-bounds source read in memcpy() can trigger fortify_panic(). This can cause a denial of service rather than returning adjacent stack contents to the reader.
How can administrators identify potentially affected configurations?
Review target configuration entries that generate LUN paths with long fabric WWNs, particularly iSCSI configurations using long IQN names. The affected function formats these paths before exposing the group-member information through sysfs.