CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer
iscsitcphdrdissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN (8192) bytes. For the LOGINRSP, TEXTRSP, REJECT and ASYNCEVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSIOPSCSICMDRSP) path also copies its data segment (sense/response data) into conn->data via iscsitcpdatarecvprep(), but it does so without the same check. The only upstream bound on in.datalen is conn->maxrecvdlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and maxrecvdlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSIOPSCSICMDRSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer
iscsitcphdrdissect() receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN (8192) bytes. For the LOGINRSP, TEXTRSP, REJECT and ASYNCEVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSIOPSCSICMDRSP) path also copies its data segment (sense/response data) into conn-data via iscsitcpdatarecvprep(), but it does so without the same check. The only upstream bound on in.datalen is conn-maxrecvdlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and maxrecvdlength therefore overflows the 8192-byte conn-data buffer.
Once the same bound applies, ISCSIOPSCSICMDRSP is handled exactly like those responses: bound the data segment, receive it into conn-data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74556?
CVE-2026-74556 has a risk rating of 62, indicating a moderate level of vulnerability severity.
How do I fix CVE-2026-74556?
To fix CVE-2026-74556, ensure that your Linux kernel is updated to the latest stable version that addresses this vulnerability.
What type of vulnerability is CVE-2026-74556?
CVE-2026-74556 is a vulnerability in the Linux kernel's libiscsi_tcp that affects the handling of SCSI response data segments.
Which software versions are affected by CVE-2026-74556?
CVE-2026-74556 affects various versions of the Linux kernel that utilize libiscsi_tcp for handling SCSI over iSCSI.
What are the potential impacts of CVE-2026-74556?
The potential impacts of CVE-2026-74556 include denial of service or unauthorized access due to improper handling of buffer sizes.