DEBIAN-CVE-2026-99154: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parsepduitt A transport that implements parsepduitt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmdsmax) i and cmdsmax are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsiparsepdu() assigns the raw tag, index = (int)itt; and beiscsicompletepdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsiverifyitt() with nothing to reject. Bound the index from below in both lookups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In both libiscsi task lookups, reject an index below zero before accessing session->cmds[i], in addition to the existing upper-bound check against session->cmds_max.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's iSCSI stack with a transport that implements parse_pdu_itt are relevant. The description specifically identifies be2iscsi, where unsolicited NOP-In PDUs forwarded from the hardware asynchronous ring can retain a target-controlled ITT.
What does an attacker need to trigger the vulnerable path?
The attacker needs to cause a negative task index to be derived from a PDU ITT. In the identified be2iscsi path, this involves an unsolicited NOP-In whose ITT is forwarded without replacement and is therefore supplied by the target.
How can affected code be recognized?
Affected code bounds the task index only from above before indexing session->cmds, allowing a negative int index to pass the check. The resolved implementation adds a lower-bound check in both lookups.