Database/Kernel, userspace & hypervisor
Linux kernel SCSI target (LIO): NULL dereference when CDB buffer allocation fails
Impact
When the SCSI target core cannot allocate a buffer for a command descriptor block, the pointer stays NULL and the error path then dereferences it, which crashes the kernel. This only matters on hosts that export storage through the in-kernel LIO target (iSCSI, FC or similar target fabrics), such as storage or gateway nodes. A crash there drops every initiator using those LUNs. The bug fires only on an allocation failure, so it is most likely under memory pressure. Hosts that do not run the LIO target are not exposed.
Who can reach it
A SCSI initiator able to send commands to a host running the LIO target, while that host fails the CDB allocation. Initiator authentication depends on the target configuration. Not reachable on hosts that do not use the kernel target.
What to do
Install a kernel with the stable fix (commits referenced below) from your distribution and reboot the target host. Plan a failover or a window for the initiators, since their LUNs go away while the target reboots. Hosts not running the LIO target can take the fix in their normal kernel cycle.
References
Related entries
- OpenSSL: QUIC listener queues unlimited pending connections, exhausting server memoryCVE-2026-14456 · OpenSSL QUIC server listener (pending-connection queue, 3.5+)High
- OpenSSL: raw-public-key endpoints with no certificate abort on a peer-sent signature_algorithms_cert extensionCVE-2026-14457 · OpenSSL TLS endpoint (RFC 7250 raw public keys, private key configured without a certificate)High
- OpenSSL QUIC: malformed INITIAL packet double-frees the record-layer object and kills the server processCVE-2026-18798 · OpenSSL QUIC server (port_default_packet_handler / port_bind_channel QRX object)High
- Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion raceCVE-2026-23148 · Linux kernel (drivers/nvme/target)High
- Linux kernel (net/tls): The queue that pins encrypted input buffers while the AEAD engine still references them wasCVE-2026-23414 · Linux kernel (net/tls)High
- Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processedCVE-2026-23440 · Linux kernel mlx5_core IPsec full offload (ESN handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.