UBUNTU-CVE-2026-99154: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parsepduitt A transport that implements parsepduitt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmdsmax) i and cmdsmax are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsiparsepdu() assigns the raw tag, index = (int)itt; and beiscsicompletepdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsiverifyitt() with nothing to reject. Bound the index from below in both lookups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In both libiscsi lookups, reject task indexes below zero before indexing session->cmds; bound the index from below as well as above.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The affected software list includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
What attacker-controlled condition reaches the vulnerable lookup?
A transport implementing parse_pdu_itt can provide an index derived from a PDU. In be2iscsi, an unsolicited NOP-In forwarded from the hardware asynchronous ring can retain a target-supplied ITT, which is converted to an int index.
What makes the invalid index pass validation?
The affected lookups checked only whether the index was greater than or equal to cmds_max. A negative index therefore passed the upper-bound check and could cause a read before the session command array; the fix adds a lower-bound check in both lookups.