CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Reserve a terminator byte for the login payload
iscsitargetcheckloginrequest() rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '>' and login->reqbuf is allocated with exactly MAXKEYVALUEPAIRS bytes. Since iscsitgetloginrx() receives payloadlength + padding bytes, where
padding = ((-payloadlength) & 3);
any payloadlength from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator.
The buffer is subsequently consumed as a C string. In the CHAP path chapcheckalgorithm() calls kstrdup(astr), and extractparam() calls strstr(inbuf, pattern) followed by strlensemi(), none of which take a length. convertnulltosemi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsiloginzerotsihs2() rewrites AuthMethod to None and the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAXKEYVALUEPAIRS bytes, so the buffer is always terminated.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel iSCSI target portals configured to use CHAP are exposed. An unauthenticated iSCSI initiator can reach the vulnerable login-processing path.
What does an attacker need to send to trigger the out-of-bounds string processing?
The attacker needs to submit an iSCSI login PDU with a DataSegmentLength from 8189 through 8192 bytes. These lengths can fill the 8192-byte login buffer without leaving space for a NUL terminator, after which CHAP-related parsing treats the buffer as a C string.