CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received
IB/isert: reject login PDUs declaring more data than was received
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Who can trigger this issue?
An iSCSI initiator able to send login PDUs to an affected IB/isert target can trigger it. The malformed login request is processed before authentication.
What does an attacker need to send?
The attacker must send a login PDU whose BHS-declared data length is larger than the data actually received. The declared length is attacker-controlled, causing later login processing to read beyond the fixed 8192-byte request buffer.
How can administrators identify possible exploitation or exposure?
Kernel memory-safety reporting may show a KASAN slab-out-of-bounds read in kmemdup_nul(), reached through iscsi_target_locate_portal() or iscsi_target_login_thread(). Systems operating an IB/isert target and accepting initiator login requests are the relevant exposure point.