CVE-2026-99154: scsi: libiscsi: Reject a negative task index from parse_pdu_itt
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Reject a negative task index from parsepduitt
A transport that implements parsepduitt hands libiscsi an index taken from the PDU, and both lookups bound it from above only:
if (i >= session->cmdsmax)
i and cmdsmax are both int, so a negative index passes and session->cmds[i] is read from before the array.
be2iscsi produces one. beiscsiparsepdu() assigns the raw tag,
index = (int)itt;
and beiscsicompletepdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsiverifyitt() with nothing to reject.
Bound the index from below in both lookups.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the libiscsi path with a transport that implements parse_pdu_itt. The described vulnerable behavior is specifically produced by be2iscsi handling an unsolicited NOP-In forwarded from its hardware asynchronous ring.
What input is needed to trigger the out-of-bounds access?
A negative task index must reach libiscsi from a PDU ITT value. In the described be2iscsi case, the unsolicited NOP-In retains a target-provided ITT, which is cast to an int and can become negative.
How is the issue addressed?
The fix adds lower-bound validation in both task lookups, rejecting negative indices before accessing session->cmds[index].
Can the age validation prevent this condition?
Not in the described be2iscsi path. It reports the session's own age rather than the age encoded in the tag, leaving iscsi_verify_itt() without an age mismatch to reject.