UBUNTU-CVE-2026-99152: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsicompletepdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSIOPLOGOUTRSP: case ISCSIOPLOGINRSP: case ISCSIOPTEXTRSP: case ISCSIOPSCSITMFUNCRSP: case ISCSIOPNOOPIN: task = iscsiitttotask(conn, hdr->itt); if (!task) return ISCSIERRBADITT; iscsiitttotask() bounds the index against cmdsmax and looks at nothing else, so a target can name any slot in the pool, including one that has never been used. task->conn is then NULL, and both iscsinopoutrsp() and iscsicompletetask() dereference it. One unsolicited NOP-In is enough; a Text Response carrying the same ITT crashes in iscsicompletetask() instead. Require the task to be in flight and not a SCSI command, the way iscsiitttoctask() does for the command opcodes. [ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.298656] RIP: 0010:iscsinopoutrsp.constprop.0+0x46/0x160 [ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206 [ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020 [ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060 [ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000 [ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800 [ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000 [ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0 [ 6.298712] PKRU: 55555554 [ 6.298713] Call Trace: [ 6.298714] <IRQ> [ 6.298714] iscsicompletepdu+0x13a8/0x22a0 [ 6.298758] iscsicompletepdu+0x54/0xa0 [ 6.298759] iscsitcphdrrecvdone+0x870/0x2c80 [ 6.298778] iscsitcprecvskb+0x31e/0xec0 [ 6.298800] iscsiswtcprecv+0x12f/0x390 [ 6.298804] tcpreadsock+0x1ab/0x810 [ 6.298812] iscsiswtcpdataready+0x18b/0x510 [ 6.298814] tcprcvestablished+0x1f56/0x3a00 [ 6.298842] tcpv4dorcv+0x449/0x960 [ 6.298847] tcpv4rcv+0x2245/0x3bc0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For management responses (ISCSI_OP_LOGOUT_RSP, ISCSI_OP_LOGIN_RSP, ISCSI_OP_TEXT_RSP, ISCSI_OP_SCSI_TMFUNC_RSP, and ISCSI_OP_NOOP_IN), require the referenced task to be in flight and not a SCSI command before processing it.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The attacker needs to act as, or control, an iSCSI target that can send crafted management responses to an affected initiator. A single unsolicited NOP-In can trigger the NULL-pointer dereference; a Text Response with the same invalid task identifier can also crash the kernel.
Which systems are realistically exposed?
Systems using the affected Ubuntu kernel packages as iSCSI initiators are exposed when they connect to an untrusted, compromised, or attacker-controlled iSCSI target. The affected package list includes linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips.
What is the impact of successful exploitation?
A malicious target can cause a kernel NULL-pointer dereference and crash the affected system, resulting in denial of service. The provided information does not establish any impact beyond the crash.
What can be done before a fixed kernel is deployed?
Avoid connecting affected initiators to untrusted iSCSI targets, and restrict iSCSI target access to trusted, authenticated infrastructure. This reduces the ability of a malicious target to deliver the crafted management response.