CVE-2026-80691: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
In the iblockexecuteprout() function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops->prclear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer.
Check whether the hooks that need to be called are supported.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the fault?
The iblock target must receive a persistent-reservation output request using PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, or PRO_RELEASE, and the required persistent-reservation callback must be unimplemented. The flawed check can then permit a NULL function-pointer dereference.
What is the likely impact of successful exploitation?
The described failure is a NULL function-pointer dereference in the Linux kernel. The provided data does not specify further impact, such as privilege escalation or information disclosure.
How can I determine whether a system is affected?
Review the kernel source or applied stable commits for a corrected iblock_execute_pr_out() implementation that checks the specific persistent-reservation hook required by each operation, rather than using ops->pr_clear for all three operations. The provided references identify stable commits containing the fix.