CVE-2026-99153: scsi: libiscsi: Validate the ITT reflected in a Reject PDU

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU

A Reject PDU carries a copy of the header it rejects, and iscsihandlereject() takes the ITT out of that copy to find the task to clean up:

memcpy(&rejectedpdu, data, sizeof(struct iscsihdr)); ... task = iscsiitttotask(conn, rejectedpdu.itt);

That value is whatever the target put there. iscsiitttotask() bounds the index against cmdsmax and checks nothing else, so any task in the pool can be named, and iscsinopoutrsp() then completes it.

An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsicompletetask() hits its WARNONONCE(task->state == ISCSITASKFREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning.

Validate the reflected ITT the way iscsiitttoctask() validates a command ITT, and require the task to be in flight and not a SCSI command.

[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsinopoutrsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] iscsicompletepdu+0x18bf/0x22a0 [ 6.256733] iscsicompletepdu+0x54/0xa0 [ 6.256905] iscsitcpdatarecvdone+0xf4/0x250 [ 6.257103] iscsitcprecvskb+0x31e/0xec0 [ 6.257680] iscsiswtcprecv+0x12f/0x390 [ 6.258061] tcpreadsock+0x1ab/0x810 [ 6.258853] iscsiswtcpdataready+0x18b/0x510 [ 6.259808] tcpdataqueue+0x1f13/0x4cd0 [ 6.260567] tcprcvestablished+0x8a5/0x3a00 [ 6.261931] tcpv4dorcv+0x449/0x960 [ 6.262269] tcpv4rcv+0x2245/0x3bc0