CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
iscsiscsicmdrsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen:
senselen = getunalignedbe16(data); if (datalen < senselen) goto invaliddatalen; memcpy(sc->sensebuffer, data + 2, mint(uint16t, senselen, SCSISENSEBUFFERSIZE));
A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSISENSEBUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace.
Account for the 2-byte sense length prefix in the check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74557?
The severity of CVE-2026-74557 is rated as 23.
What does CVE-2026-74557 involve?
CVE-2026-74557 involves a stale-data leak into the SCSI sense buffer within the Linux kernel's scsi: libiscsi module.
How can CVE-2026-74557 be mitigated?
To mitigate CVE-2026-74557, users should update their Linux kernel to the version that includes the fix for this vulnerability.
What impact does CVE-2026-74557 have on systems?
CVE-2026-74557 can potentially expose sensitive information through leaked stale data in the SCSI sense buffer.
When was CVE-2026-74557 published?
CVE-2026-74557 was published on August 15, 2026.